Loading story…
A leaked LockBit 3.0 builder and companion key-generation utility exposed how the ransomware operation creates customized encryptor and decryptor payloads, raising concern that other actors could launch LockBit-derived campaigns. Technical analyses said the toolkit included files such as Builder.exe, Keygen.exe, Build.bat, and config.json, and could package RSA keys, configuration data, ransom-note text, and embedded resources into PE executables or DLLs for both encryption and decryption workflows. Reports linked the leak to claims that a third party had infiltrated LockBit infrastructure and later shared the builder publicly, while LockBit reportedly downplayed the incident and blamed a dismissed developer.
The leaked code also revealed operational and defensive-evasion details from one of the most prolific ransomware-as-a-service groups. Researchers said LockBit 3.0—also known as LockBit Black and tied to BlackMatter lineage—used anti-analysis measures including runtime decryption, debugger checks, trampolines, and manipulation of DbgUiRemoteBreakin, while preserving capabilities for privilege escalation, persistence, process and service termination, rapid encryption, and ransom-note deployment. Analyses of the builder described support for exclusion lists, C2 URLs, impersonation accounts, and cryptographic routines including RSA key handling, MIRACL-based generation, hardware-assisted randomness via RDRAND and RDSEED, and creation of victim-specific identifiers, giving defenders and criminals alike an unusually detailed view into LockBit’s tooling.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
The LockBit 3.0 builder and related materials became available online on September 21, 2022. Separate reporting says the leaked builder was subsequently shared via 3xp0rt's GitHub and was tied to claims that Ali Qushji obtained it from LockBit infrastructure.
The leaked LockBit 3.0 builder analyzed in later reports was compiled on September 13, 2022. This builder packaged resources for generating encryptor and decryptor payloads.
LockBit operators and affiliates began moving to LockBit 3.0 around June 2022. The transition was accompanied by new leak sites, mirror sites, affiliate-management features, and added payment options such as Zcash.
After critical bugs were discovered in LockBit 2.0, the operators began updating the ransomware, leading to development of LockBit 3.0/LockBit Black.
Following the builder leak, LockBit reportedly responded that nothing had been hacked while saying the coder had been fired. The statement was described as an indirect acknowledgment that the leaked builder was genuine.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
medium.com
Open sourcecybergeeks.tech
Open sourcesentinelone.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that multiple ransomware families, including **DoNex**, **BabLock/Rorschach**, and **LockBit Black (v3)**, share substantial code and operational overlap with **LockBit**, underscoring how leaked builder code and recycled components continue to fuel new strains. SANS assessed DoNex as an unoriginal **LockBit-derived** operation closely resembling **Darkrace**, with behavior including process and service termination, network-share enumeration, event-log clearing, ransom-note deployment, and forced reboot after encryption. Trend Micro similarly found that BabLock appears heavily based on **LockBit 2.0** while incorporating features from other families, using DLL sideloading, Direct SysCalls, VMProtect, and unusual random numeric file extensions. Separate reverse engineering of LockBit v3 identified serious implementation flaws, including a **keystream reuse** bug and a design issue that could cause permanent data corruption, enabling partial decryption in some cases via an open-source decryptor. Operational reporting also showed LockBit affiliates continuing to refine delivery and post-exploitation methods. ASEC documented phishing emails posing as copyright claims that delivered LockBit through nested password-protected archives and a fake PDF executable, after which the malware deleted shadow copies, altered boot recovery settings, established persistence, and encrypted files with the `.lockbit` extension. SentinelOne described a LockBit-linked intrusion that began with **Log4Shell** exploitation against an unpatched **VMware Horizon** server and progressed to abuse of legitimate Microsoft Defender tooling for DLL sideloading of **Cobalt Strike**, alongside PowerShell execution, web-shell deployment, and other living-off-the-land techniques. Together with earlier DarkSide analysis showing similar use of **Salsa20/RSA**, service killing, shadow-copy deletion, and network-resource encryption, the reports show a ransomware ecosystem in which LockBit code, cryptography, and tradecraft are repeatedly repackaged into new campaigns and variants.
Aug 15, 2026
LockBit expanded its ransomware-as-a-service operations with **StealBit**, a custom exfiltration tool used by affiliates to steal data before encryption and support double-extortion demands. Research shows StealBit was built for high-throughput theft, using named-pipe interprocess communication via `STEALBIT-MASTER-PIPE` and Windows I/O completion ports to parallelize transfers, while sending stolen file contents over HTTP `PUT` requests to attacker-controlled infrastructure embedded in the malware. Analysts also found anti-analysis checks, encrypted strings and endpoint data, and later versions that added self-deletion, transfer throttling, and partial window-hiding, although some advertised features such as hidden execution and compression were incomplete or misleading in examined samples. The tool formed part of the broader **LockBit 2.0** playbook, which resurfaced as a more aggressive operation combining rapid encryption, data theft, and automated spread across Windows domains through Active Directory group policies. Trend Micro reported detections tied to LockBit 2.0 activity in Chile, Italy, Taiwan, and the UK, noting that affiliates also abused legitimate tools such as Process Hacker and PC Hunter and used scripts to disable defenses, stop services, and clear logs. The ransomware partially encrypted files, appended the `.lockbit` extension, dropped `Restore-My-Files.txt` ransom notes, and threatened to leak stolen data, while later research tracked the gang’s exfiltration infrastructure as defenders worked to hunt StealBit-related activity.
Aug 14, 2026
Researchers analyzed a leaked **Babuk ransomware builder** and concluded it is likely authentic, showing it can generate platform-specific encryptor and decryptor binaries for **Windows**, **ARM-based NAS devices**, and **VMware ESXi** servers. The leaked package reportedly included a Windows builder executable, binary templates, Unix executables, and a ransom note template, and reverse engineering found strong similarities between builder-produced samples and known Babuk malware, including closely matching structure, encryption behavior, and assembly code. Analysts said the builder can either create elliptic-curve keys automatically or accept a supplied key, allowing operators to reuse the same decryption executable across multiple builds. The generated Babuk payloads were reported to delete shadow copies, disrupt **VSS**-related activity, empty the recycle bin, drop ransom notes named **"How to Restore Your Files.txt"**, append the **`.babyk`** extension to encrypted files, and add the signature **"choung dong looks like hot dog!!"**. The corresponding decryptor searches for `.babyk` files, validates and removes the signature, restores file contents, deletes ransom notes, and displays a completion message. Researchers said the leak could help defenders improve **IoCs**, **YARA** detections, and tracking of unofficial Babuk variants, while also lowering the barrier for other ransomware actors to reuse the tooling.
Aug 15, 2026