Loading story…
Researchers reported that multiple ransomware families, including DoNex, BabLock/Rorschach, and LockBit Black (v3), share substantial code and operational overlap with LockBit, underscoring how leaked builder code and recycled components continue to fuel new strains. SANS assessed DoNex as an unoriginal LockBit-derived operation closely resembling Darkrace, with behavior including process and service termination, network-share enumeration, event-log clearing, ransom-note deployment, and forced reboot after encryption. Trend Micro similarly found that BabLock appears heavily based on LockBit 2.0 while incorporating features from other families, using DLL sideloading, Direct SysCalls, VMProtect, and unusual random numeric file extensions. Separate reverse engineering of LockBit v3 identified serious implementation flaws, including a keystream reuse bug and a design issue that could cause permanent data corruption, enabling partial decryption in some cases via an open-source decryptor.
Operational reporting also showed LockBit affiliates continuing to refine delivery and post-exploitation methods. ASEC documented phishing emails posing as copyright claims that delivered LockBit through nested password-protected archives and a fake PDF executable, after which the malware deleted shadow copies, altered boot recovery settings, established persistence, and encrypted files with the .lockbit extension. SentinelOne described a LockBit-linked intrusion that began with Log4Shell exploitation against an unpatched VMware Horizon server and progressed to abuse of legitimate Microsoft Defender tooling for DLL sideloading of Cobalt Strike, alongside PowerShell execution, web-shell deployment, and other living-off-the-land techniques. Together with earlier DarkSide analysis showing similar use of Salsa20/RSA, service killing, shadow-copy deletion, and network-resource encryption, the reports show a ransomware ecosystem in which LockBit code, cryptography, and tradecraft are repeatedly repackaged into new campaigns and variants.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
Calif analyzed a LockBit v3/LockBit Black variant built from the leaked builder, identified a keystream-reuse crypto bug and a design flaw that can cause permanent corruption, and published an open-source decryptor. The report also noted newer variants in the wild no longer allowed exploitation of the crypto bug.
A SANS Internet Storm Center analysis concluded that DoNex is an unoriginal ransomware operation derived from leaked LockBit builder code and closely resembling the earlier Darkrace ransomware. The write-up documented its encryption workflow, service and process disruption, network-share encryption, and forced reboot behavior.
The SANS analysis states that Darkrace appeared in mid-June 2023 and closely resembled binaries produced from the leaked LockBit builder.
Trend Micro published an analysis of BabLock/Rorschach, describing its multi-component delivery, Direct SysCall use, VMProtect packing, unusual extension scheme, and use of tools such as Chisel and Fscan.
SentinelOne described a LockBit-attributed intrusion in which attackers exploited Log4j on an unpatched VMware Horizon Server, installed a web shell in Blast Secure Gateway, and used MpCmdRun.exe to sideload a malicious DLL that decrypted and loaded Cobalt Strike Beacon.
ASEC reported a phishing campaign distributing LockBit ransomware through emails disguised as copyright-claim messages, using nested compressed attachments and an executable masquerading as a PDF. The report also published malware behavior details and MD5 indicators.
Trend Micro said researchers discovered the BabLock ransomware family in June 2022 and later assessed it as a hybrid strain heavily based on LockBit 2.0 but distinct from core LockBit operators.
Trend Micro reported that the earliest records of BabLock (Rorschach)-related files it found were from March 2022, indicating the ransomware family was present by then.
A reverse-engineering analysis documented DarkSide ransomware version 1.8.6.2 for Windows, detailing its hybrid RSA-1024/Salsa20 cryptosystem, UAC bypass, shadow copy deletion, service and process killing, network-share encryption, and C2 reporting.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
blog.calif.io
Open sourceisc.sans.edu
Open sourcetrendmicro.com
Open sourcesentinelone.com
Open sourceasec.ahnlab.com
Open sourcechuongdong.com
Open sourcetrendmicro.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A leaked **LockBit 3.0** builder and companion key-generation utility exposed how the ransomware operation creates customized encryptor and decryptor payloads, raising concern that other actors could launch LockBit-derived campaigns. Technical analyses said the toolkit included files such as `Builder.exe`, `Keygen.exe`, `Build.bat`, and `config.json`, and could package RSA keys, configuration data, ransom-note text, and embedded resources into PE executables or DLLs for both encryption and decryption workflows. Reports linked the leak to claims that a third party had infiltrated LockBit infrastructure and later shared the builder publicly, while LockBit reportedly downplayed the incident and blamed a dismissed developer. The leaked code also revealed operational and defensive-evasion details from one of the most prolific ransomware-as-a-service groups. Researchers said **LockBit 3.0**—also known as **LockBit Black** and tied to BlackMatter lineage—used anti-analysis measures including runtime decryption, debugger checks, trampolines, and manipulation of `DbgUiRemoteBreakin`, while preserving capabilities for privilege escalation, persistence, process and service termination, rapid encryption, and ransom-note deployment. Analyses of the builder described support for exclusion lists, C2 URLs, impersonation accounts, and cryptographic routines including RSA key handling, MIRACL-based generation, hardware-assisted randomness via `RDRAND` and `RDSEED`, and creation of victim-specific identifiers, giving defenders and criminals alike an unusually detailed view into LockBit’s tooling.
Aug 15, 2026
LockBit expanded its ransomware-as-a-service operations with **StealBit**, a custom exfiltration tool used by affiliates to steal data before encryption and support double-extortion demands. Research shows StealBit was built for high-throughput theft, using named-pipe interprocess communication via `STEALBIT-MASTER-PIPE` and Windows I/O completion ports to parallelize transfers, while sending stolen file contents over HTTP `PUT` requests to attacker-controlled infrastructure embedded in the malware. Analysts also found anti-analysis checks, encrypted strings and endpoint data, and later versions that added self-deletion, transfer throttling, and partial window-hiding, although some advertised features such as hidden execution and compression were incomplete or misleading in examined samples. The tool formed part of the broader **LockBit 2.0** playbook, which resurfaced as a more aggressive operation combining rapid encryption, data theft, and automated spread across Windows domains through Active Directory group policies. Trend Micro reported detections tied to LockBit 2.0 activity in Chile, Italy, Taiwan, and the UK, noting that affiliates also abused legitimate tools such as Process Hacker and PC Hunter and used scripts to disable defenses, stop services, and clear logs. The ransomware partially encrypted files, appended the `.lockbit` extension, dropped `Restore-My-Files.txt` ransom notes, and threatened to leak stolen data, while later research tracked the gang’s exfiltration infrastructure as defenders worked to hunt StealBit-related activity.
Aug 14, 2026
LockBit grew from an early ABCD ransomware strain into one of the most prolific ransomware-as-a-service operations, combining fast multithreaded encryption, **double extortion**, and affiliate-driven intrusions against corporate victims worldwide. Researchers and incident reporting tied the group to tactics including UAC bypasses, shadow-copy deletion, log clearing, network-share encryption, and later campaigns using evasive multi-stage loaders, Safe Mode persistence, and password-protected payload delivery. The operation also recruited insiders for direct access to enterprise networks, soliciting VPN, RDP, and email credentials and offering large payouts to employees willing to run malware inside their organizations. LockBit’s criminal ecosystem evolved alongside broader ransomware market shifts, with reporting linking it to affiliate churn, code overlap with other families, and adoption of a modified Conti-based payload branded as **LockBit Green**. By 2023, analysts reported infrastructure and leak-site reliability problems that frustrated affiliates, even as the gang remained tied to major incidents such as the Royal Mail attack. In 2024, Operation Cronos disrupted LockBit infrastructure and seized decryption keys, and U.S., U.K., and Australian authorities later sanctioned and charged Russian national **Dmitry Yuryevich Khoroshev** as the alleged leader, saying LockBit hit more than 2,500 victims in at least 120 countries, collected at least **$500 million** in ransom, and caused billions in wider losses.
Aug 15, 2026