Loading story…
A new SolidBit ransomware variant has been distributed through fraudulent applications aimed at gamers and social media users, including fake League of Legends account checker, Social Hacker, and Instagram Follower Bot tools hosted on GitHub. Trend Micro reported that the lures execute PowerShell to weaken parts of Windows Defender, drop additional executables, and then deploy the ransomware payload, expanding the group’s reach beyond traditional enterprise intrusion methods.
The payload is a .NET binary that uses obfuscation, anti-debugging techniques, persistence through the Windows Run registry key, AES-256 encryption, shadow copy deletion, service termination, and ransom note deployment. Researchers said the malware appears to be a rebranded Yashma/Chaos-derived strain rather than a genuine LockBit variant, despite similarities in presentation, and noted that the operators were promoting a ransomware-as-a-service model on underground forums with affiliates offered 80% of ransom payments.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
On August 2, 2022, Trend Micro researchers analyzed a new SolidBit ransomware variant distributed via fake GitHub-hosted tools such as a League of Legends account checker, Social Hacker, and Instagram Follower Bot. The report said the malware disabled parts of Windows Defender, deployed the ransomware payload, and was likely a Yashma/Chaos-derived strain rather than a true LockBit variant.
A researcher found that the SolidBit group posted an underground forum advertisement on June 29 seeking ransomware-as-a-service affiliates and offering them 80% of ransom payments. This indicated the group's move to expand through an affiliate model.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that multiple ransomware families, including **DoNex**, **BabLock/Rorschach**, and **LockBit Black (v3)**, share substantial code and operational overlap with **LockBit**, underscoring how leaked builder code and recycled components continue to fuel new strains. SANS assessed DoNex as an unoriginal **LockBit-derived** operation closely resembling **Darkrace**, with behavior including process and service termination, network-share enumeration, event-log clearing, ransom-note deployment, and forced reboot after encryption. Trend Micro similarly found that BabLock appears heavily based on **LockBit 2.0** while incorporating features from other families, using DLL sideloading, Direct SysCalls, VMProtect, and unusual random numeric file extensions. Separate reverse engineering of LockBit v3 identified serious implementation flaws, including a **keystream reuse** bug and a design issue that could cause permanent data corruption, enabling partial decryption in some cases via an open-source decryptor. Operational reporting also showed LockBit affiliates continuing to refine delivery and post-exploitation methods. ASEC documented phishing emails posing as copyright claims that delivered LockBit through nested password-protected archives and a fake PDF executable, after which the malware deleted shadow copies, altered boot recovery settings, established persistence, and encrypted files with the `.lockbit` extension. SentinelOne described a LockBit-linked intrusion that began with **Log4Shell** exploitation against an unpatched **VMware Horizon** server and progressed to abuse of legitimate Microsoft Defender tooling for DLL sideloading of **Cobalt Strike**, alongside PowerShell execution, web-shell deployment, and other living-off-the-land techniques. Together with earlier DarkSide analysis showing similar use of **Salsa20/RSA**, service killing, shadow-copy deletion, and network-resource encryption, the reports show a ransomware ecosystem in which LockBit code, cryptography, and tradecraft are repeatedly repackaged into new campaigns and variants.
Aug 15, 2026
Researchers tied **Lyposit**, **Lucky Locker**, and **Bomba Locker** to a closely related lockscreen ransomware operation that used geographically tailored ransom pages, affiliate-style distribution, and command-and-control infrastructure to lock Windows systems. Analysis linked the malware families through shared panel behavior, similar country-specific screen designs, and overlapping technical traits, while reporting that the operation targeted victims in the United States and multiple European countries and was distributed through exploit-kit traffic including **ProPack**, **BH EK/q.php**, and **Darkleech**. Technical reviews showed a multi-stage infection chain involving a Visual Basic dropper, an intermediate loader, RC2-based decryption, and a final DLL payload that installed persistence and fetched HTML ransom content from remote servers using **BITS**, **WinINet**, and encrypted communications. The malware reportedly supported Safe Mode persistence, command processor modification, process injection, memory-only loading, antivirus evasion, and a **Windows Vista/7 UAC bypass**, while some ransom screens even mimicked a **Mac OS** interface despite infecting Windows hosts.
Aug 15, 2026
LockBit expanded its ransomware-as-a-service operations with **StealBit**, a custom exfiltration tool used by affiliates to steal data before encryption and support double-extortion demands. Research shows StealBit was built for high-throughput theft, using named-pipe interprocess communication via `STEALBIT-MASTER-PIPE` and Windows I/O completion ports to parallelize transfers, while sending stolen file contents over HTTP `PUT` requests to attacker-controlled infrastructure embedded in the malware. Analysts also found anti-analysis checks, encrypted strings and endpoint data, and later versions that added self-deletion, transfer throttling, and partial window-hiding, although some advertised features such as hidden execution and compression were incomplete or misleading in examined samples. The tool formed part of the broader **LockBit 2.0** playbook, which resurfaced as a more aggressive operation combining rapid encryption, data theft, and automated spread across Windows domains through Active Directory group policies. Trend Micro reported detections tied to LockBit 2.0 activity in Chile, Italy, Taiwan, and the UK, noting that affiliates also abused legitimate tools such as Process Hacker and PC Hunter and used scripts to disable defenses, stop services, and clear logs. The ransomware partially encrypted files, appended the `.lockbit` extension, dropped `Restore-My-Files.txt` ransom notes, and threatened to leak stolen data, while later research tracked the gang’s exfiltration infrastructure as defenders worked to hunt StealBit-related activity.
Aug 14, 2026