Loading story…
Researchers reported a new LockBit 4.0 ransomware line, including the LockBit 4 Green variant, with fresh indicators of compromise and updated operational tooling. Public reporting tied the release to December 2024 and published two executable hashes, multiple hashes for three associated PowerShell script families, ten IP addresses allegedly contacted by those scripts, and a broad set of Tor .onion domains linked to LockBit infrastructure. The reporting also said the malware uses a new ransom note and introduced 12 new PowerShell files that defenders can use for detection and threat hunting.
Technical analysis of LockBit 4 Green showed a packed 64-bit executable that decrypts a second-stage payload from the .data section and relies on importless execution with API hashing, XOR-based string decryption, and proxy DLL loading via RtlQueueWorkItem. The ransomware also employed multiple defense-evasion measures, including ETW patching, removal of DLL notifications, module unhooking, and clearing vectored exception handlers, while checking for Russian language settings and system architecture before execution. Once active, it disabled Volume Shadow Copy and Windows Search-related functionality, applied file and path exclusions, and used partial encryption that encrypted all files smaller than 1 MB while encrypting roughly 27% of larger files.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
A separate analysis examines the LockBit 4 Green variant's unpacking, API hashing, string decryption, proxy DLL loading, anti-monitoring techniques, and operational behaviors such as service disabling and partial encryption logic.
Analysis of the LockBit 4 Green variant states it is a newer version announced by the LockBit group in December 2024. This marks the emergence of the LockBit 4 line referenced by the later technical reporting.
A threat-intelligence style post claims LockBit 4.0 had recently been released and publishes indicators including executable hashes, PowerShell script hashes, contacted IP addresses, Tor onion domains, and notes about a new ransom note and 12 new PowerShell files.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 78 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers report that **LockBit has resumed operations** with a new **LockBit 5.0** strain that targets **Windows, Linux, and VMware ESXi** systems, extending the group’s established cross-platform ransomware model after the disruption caused by Operation Cronos. Analysis of a newly discovered sample found strong code continuity with **LockBit 4.0**, indicating the malware is an evolution of the original codebase rather than a copycat. The new version adds heavy obfuscation, anti-analysis, and anti-forensics capabilities, including in-memory payload loading through DLL reflection, ETW patching, security service termination, and event log clearing, while the ESXi variant is built to encrypt virtualized environments at scale. Separate reporting ties LockBit activity to real-world intrusions and common access vectors. SecurityScorecard assessed a claimed attack on a major **state-owned Southeast Asian bank** and found network and malware evidence consistent with credential theft, **SSH/RDP-based access**, and possible data exfiltration before and after the victim appeared on LockBit’s leak site, though some public claims could not be independently verified. Another SecurityScorecard investigation found attackers exploiting **PaperCut** flaws **`CVE-2023-27350`** and **`CVE-2023-27351`**, with **`CVE-2023-27350`** used to deliver LockBit in observed cases, underscoring how the group and its affiliates continue to pair opportunistic vulnerability exploitation with mature, multi-platform ransomware tooling.
Aug 21, 2026
LockBit grew from an early ABCD ransomware strain into one of the most prolific ransomware-as-a-service operations, combining fast multithreaded encryption, **double extortion**, and affiliate-driven intrusions against corporate victims worldwide. Researchers and incident reporting tied the group to tactics including UAC bypasses, shadow-copy deletion, log clearing, network-share encryption, and later campaigns using evasive multi-stage loaders, Safe Mode persistence, and password-protected payload delivery. The operation also recruited insiders for direct access to enterprise networks, soliciting VPN, RDP, and email credentials and offering large payouts to employees willing to run malware inside their organizations. LockBit’s criminal ecosystem evolved alongside broader ransomware market shifts, with reporting linking it to affiliate churn, code overlap with other families, and adoption of a modified Conti-based payload branded as **LockBit Green**. By 2023, analysts reported infrastructure and leak-site reliability problems that frustrated affiliates, even as the gang remained tied to major incidents such as the Royal Mail attack. In 2024, Operation Cronos disrupted LockBit infrastructure and seized decryption keys, and U.S., U.K., and Australian authorities later sanctioned and charged Russian national **Dmitry Yuryevich Khoroshev** as the alleged leader, saying LockBit hit more than 2,500 victims in at least 120 countries, collected at least **$500 million** in ransom, and caused billions in wider losses.
Aug 15, 2026
Researchers reported that multiple ransomware families, including **DoNex**, **BabLock/Rorschach**, and **LockBit Black (v3)**, share substantial code and operational overlap with **LockBit**, underscoring how leaked builder code and recycled components continue to fuel new strains. SANS assessed DoNex as an unoriginal **LockBit-derived** operation closely resembling **Darkrace**, with behavior including process and service termination, network-share enumeration, event-log clearing, ransom-note deployment, and forced reboot after encryption. Trend Micro similarly found that BabLock appears heavily based on **LockBit 2.0** while incorporating features from other families, using DLL sideloading, Direct SysCalls, VMProtect, and unusual random numeric file extensions. Separate reverse engineering of LockBit v3 identified serious implementation flaws, including a **keystream reuse** bug and a design issue that could cause permanent data corruption, enabling partial decryption in some cases via an open-source decryptor. Operational reporting also showed LockBit affiliates continuing to refine delivery and post-exploitation methods. ASEC documented phishing emails posing as copyright claims that delivered LockBit through nested password-protected archives and a fake PDF executable, after which the malware deleted shadow copies, altered boot recovery settings, established persistence, and encrypted files with the `.lockbit` extension. SentinelOne described a LockBit-linked intrusion that began with **Log4Shell** exploitation against an unpatched **VMware Horizon** server and progressed to abuse of legitimate Microsoft Defender tooling for DLL sideloading of **Cobalt Strike**, alongside PowerShell execution, web-shell deployment, and other living-off-the-land techniques. Together with earlier DarkSide analysis showing similar use of **Salsa20/RSA**, service killing, shadow-copy deletion, and network-resource encryption, the reports show a ransomware ecosystem in which LockBit code, cryptography, and tradecraft are repeatedly repackaged into new campaigns and variants.
Aug 15, 2026