Loading story…
LockBit expanded its ransomware-as-a-service operations with StealBit, a custom exfiltration tool used by affiliates to steal data before encryption and support double-extortion demands. Research shows StealBit was built for high-throughput theft, using named-pipe interprocess communication via STEALBIT-MASTER-PIPE and Windows I/O completion ports to parallelize transfers, while sending stolen file contents over HTTP PUT requests to attacker-controlled infrastructure embedded in the malware. Analysts also found anti-analysis checks, encrypted strings and endpoint data, and later versions that added self-deletion, transfer throttling, and partial window-hiding, although some advertised features such as hidden execution and compression were incomplete or misleading in examined samples.
The tool formed part of the broader LockBit 2.0 playbook, which resurfaced as a more aggressive operation combining rapid encryption, data theft, and automated spread across Windows domains through Active Directory group policies. Trend Micro reported detections tied to LockBit 2.0 activity in Chile, Italy, Taiwan, and the UK, noting that affiliates also abused legitimate tools such as Process Hacker and PC Hunter and used scripts to disable defenses, stop services, and clear logs. The ransomware partially encrypted files, appended the .lockbit extension, dropped Restore-My-Files.txt ransom notes, and threatened to leak stolen data, while later research tracked the gang’s exfiltration infrastructure as defenders worked to hunt StealBit-related activity.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Attack attempts involving LockBit 2.0 were detected between July 1 and August 15, 2021, affecting organizations in Chile, Italy, Taiwan, and the UK.
Trend Micro reported that the LockBit ransomware group resurfaced in June 2021 with LockBit 2.0, a ransomware-as-a-service variant that added double-extortion capabilities and provided affiliates with the StealBit exfiltration tool.
Cybereason published a technical analysis of StealBit describing it as a custom LockBit exfiltration tool used in double-extortion operations and documenting its architecture, anti-analysis behavior, and exfiltration methods.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
yoroi.company
Open sourcecybereason.com
Open sourcetrendmicro.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
LockBit grew from an early ABCD ransomware strain into one of the most prolific ransomware-as-a-service operations, combining fast multithreaded encryption, **double extortion**, and affiliate-driven intrusions against corporate victims worldwide. Researchers and incident reporting tied the group to tactics including UAC bypasses, shadow-copy deletion, log clearing, network-share encryption, and later campaigns using evasive multi-stage loaders, Safe Mode persistence, and password-protected payload delivery. The operation also recruited insiders for direct access to enterprise networks, soliciting VPN, RDP, and email credentials and offering large payouts to employees willing to run malware inside their organizations. LockBit’s criminal ecosystem evolved alongside broader ransomware market shifts, with reporting linking it to affiliate churn, code overlap with other families, and adoption of a modified Conti-based payload branded as **LockBit Green**. By 2023, analysts reported infrastructure and leak-site reliability problems that frustrated affiliates, even as the gang remained tied to major incidents such as the Royal Mail attack. In 2024, Operation Cronos disrupted LockBit infrastructure and seized decryption keys, and U.S., U.K., and Australian authorities later sanctioned and charged Russian national **Dmitry Yuryevich Khoroshev** as the alleged leader, saying LockBit hit more than 2,500 victims in at least 120 countries, collected at least **$500 million** in ransom, and caused billions in wider losses.
Aug 15, 2026
Researchers reported that multiple ransomware families, including **DoNex**, **BabLock/Rorschach**, and **LockBit Black (v3)**, share substantial code and operational overlap with **LockBit**, underscoring how leaked builder code and recycled components continue to fuel new strains. SANS assessed DoNex as an unoriginal **LockBit-derived** operation closely resembling **Darkrace**, with behavior including process and service termination, network-share enumeration, event-log clearing, ransom-note deployment, and forced reboot after encryption. Trend Micro similarly found that BabLock appears heavily based on **LockBit 2.0** while incorporating features from other families, using DLL sideloading, Direct SysCalls, VMProtect, and unusual random numeric file extensions. Separate reverse engineering of LockBit v3 identified serious implementation flaws, including a **keystream reuse** bug and a design issue that could cause permanent data corruption, enabling partial decryption in some cases via an open-source decryptor. Operational reporting also showed LockBit affiliates continuing to refine delivery and post-exploitation methods. ASEC documented phishing emails posing as copyright claims that delivered LockBit through nested password-protected archives and a fake PDF executable, after which the malware deleted shadow copies, altered boot recovery settings, established persistence, and encrypted files with the `.lockbit` extension. SentinelOne described a LockBit-linked intrusion that began with **Log4Shell** exploitation against an unpatched **VMware Horizon** server and progressed to abuse of legitimate Microsoft Defender tooling for DLL sideloading of **Cobalt Strike**, alongside PowerShell execution, web-shell deployment, and other living-off-the-land techniques. Together with earlier DarkSide analysis showing similar use of **Salsa20/RSA**, service killing, shadow-copy deletion, and network-resource encryption, the reports show a ransomware ecosystem in which LockBit code, cryptography, and tradecraft are repeatedly repackaged into new campaigns and variants.
Aug 15, 2026
An international law enforcement operation led by the UK's National Crime Agency and the FBI seized LockBit infrastructure on 19 February 2024, disrupting one of the world's most prolific ransomware-as-a-service groups. Follow-on actions publicly identified and sanctioned a senior LockBit leader, while officials said the campaign targeted the gang's administrators, infrastructure, and criminal affiliates. Subsequent reporting said the disruption sharply reduced LockBit's standing in ransomware rankings after years in which the group had claimed thousands of victims across more than 100 countries. Threat research shows LockBit's reach was driven by a scalable affiliate model rather than malware alone, with intrusions commonly starting through abused VPN, Citrix, and RDP access or stolen credentials, followed by use of tools such as **Impacket**, **Mimikatz**, **PsExec**, **Rclone**, and **StealBit**. Affiliates increasingly targeted **VMware ESXi** environments to maximize operational impact, and some skipped encryption entirely in favor of data-theft extortion using LockBit-branded notes. The group's earlier attacks included a reported **$80 million** demand against CDW, but researchers and investigators warn that even as LockBit declines, its affiliates and copycats are likely to continue operating under other ransomware brands.
Aug 14, 2026