Loading story…
LockBit 3.0, also known as LockBit Black, became the most prolific ransomware-as-a-service platform, targeting sectors like healthcare, manufacturing, and government worldwide. Despite a major multinational takedown (Operation Cronos) in early 2024 and the unmasking of its leader, the group’s leaked builder and affiliate model have enabled continued attacks and copycat operations. LockBit now persists as a fragmented but influential ecosystem, with affiliates leveraging its tools for ongoing extortion campaigns.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
15 events from the most recent confirmed update back to the earliest known activity.
Initial story creation
The U.S. Department of Justice announced a superseding criminal complaint charging dual Russian-Israeli national Rostislav Panev with serving as a developer for the LockBit ransomware group from around 2019 through at least February 2024. Authorities said Panev was arrested in Israel in August 2024 on a U.S. provisional arrest request and remained in custody pending extradition.
Europol said coordinated actions by France, the United Kingdom, and Spain led to the arrests of four people linked to LockBit, including a developer and a bulletproof hosting service administrator. Authorities also imposed financial sanctions against affiliates, marking a new post-disruption law enforcement action against the group.
The U.S. Department of Justice announced that LockBit affiliates Ruslan Magomedovich Astamirov and Mikhail Vasiliev pleaded guilty to participating in the ransomware group and carrying out attacks against victims in the United States and worldwide. The pleas marked a new prosecutorial milestone following the February 2024 international disruption of LockBit.
LockBit publicly claimed it had hacked the U.S. Federal Reserve, but by June 2024 the claim appeared to fizzle without evidence of a confirmed breach. The episode marked a notable claimed victim disclosure tied to LockBit's post-disruption activity.
Authorities in the United States, United Kingdom, and Australia publicly identified a LockBit administrator and imposed coordinated sanctions against him. The action marked a new law enforcement and attribution step following the February 2024 disruption of LockBit's infrastructure.
LockBit's seized darknet leak site briefly reappeared under apparent law enforcement control, displaying a message teasing that more information about the ransomware group would be released soon. The move represented a new post-takedown operational message from authorities following the February 2024 disruption.
Authorities from multiple countries disrupted LockBit's operations in a coordinated law enforcement action, targeting the ransomware group's infrastructure. The operation marked a significant escalation against LockBit beyond prior government warnings and assessments.
Australia's ASD Australian Cyber Security Centre published an official ransomware profile on LockBit 3.0, providing government guidance and threat information about the group's tactics and risks. The advisory marked a formal Australian government assessment and awareness effort focused on LockBit.
LockBit introduced a new ransomware variant called 'LockBit Green,' marking an operational and technical expansion of the group's malware lineup. The release was publicly reported on 2023-02-02.
Canada's Communications Security Establishment publicly warned that the Russian-linked LockBit ransomware group posed an 'enduring threat' to Canadian organizations. The assessment marked an official Canadian government statement on the group's ongoing risk to the country.
LockBit claimed in August 2022 that it had breached digital security firm Entrust and began using DDoS attacks as part of its extortion pressure campaign. The incident marked a new publicly disclosed victim claim tied to LockBit's operations.
LockBit publicly launched a new ransomware version known as LockBit 3.0, also referred to as LockBit Black. The release marked a significant evolution of the group's tooling and operations and was reported on July 5, 2022.
AhnLab reported that in July 2022 LockBit affiliates compromised a customer's Microsoft Exchange server, deployed a web shell, escalated to Active Directory administrator within seven days, stole about 1.3 TB of data, and then encrypted systems across the network. The researchers said the initial access may have involved an undisclosed Exchange zero-day, though that claim was disputed by other security researchers.
LockBit publicly introduced what was described as the first ransomware bug bounty program as part of its LockBit 3.0 rollout. The initiative invited researchers and affiliates to report vulnerabilities and ideas to improve the group's criminal platform.
25 references tracked. Mallory keeps watching after this page renders.
blog.compass-security.com
Open sourceinfosecwriteups.com
Open sourcescworld.com
Open sourcejustice.gov
Open sourcecyble.com
Open sourceblog.cyble.com
Open sourcebleepingcomputer.com
Open sourcebitdefender.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
An international law enforcement operation led by the UK's National Crime Agency and the FBI seized LockBit infrastructure on 19 February 2024, disrupting one of the world's most prolific ransomware-as-a-service groups. Follow-on actions publicly identified and sanctioned a senior LockBit leader, while officials said the campaign targeted the gang's administrators, infrastructure, and criminal affiliates. Subsequent reporting said the disruption sharply reduced LockBit's standing in ransomware rankings after years in which the group had claimed thousands of victims across more than 100 countries. Threat research shows LockBit's reach was driven by a scalable affiliate model rather than malware alone, with intrusions commonly starting through abused VPN, Citrix, and RDP access or stolen credentials, followed by use of tools such as **Impacket**, **Mimikatz**, **PsExec**, **Rclone**, and **StealBit**. Affiliates increasingly targeted **VMware ESXi** environments to maximize operational impact, and some skipped encryption entirely in favor of data-theft extortion using LockBit-branded notes. The group's earlier attacks included a reported **$80 million** demand against CDW, but researchers and investigators warn that even as LockBit declines, its affiliates and copycats are likely to continue operating under other ransomware brands.
Aug 14, 2026
LockBit grew from an early ABCD ransomware strain into one of the most prolific ransomware-as-a-service operations, combining fast multithreaded encryption, **double extortion**, and affiliate-driven intrusions against corporate victims worldwide. Researchers and incident reporting tied the group to tactics including UAC bypasses, shadow-copy deletion, log clearing, network-share encryption, and later campaigns using evasive multi-stage loaders, Safe Mode persistence, and password-protected payload delivery. The operation also recruited insiders for direct access to enterprise networks, soliciting VPN, RDP, and email credentials and offering large payouts to employees willing to run malware inside their organizations. LockBit’s criminal ecosystem evolved alongside broader ransomware market shifts, with reporting linking it to affiliate churn, code overlap with other families, and adoption of a modified Conti-based payload branded as **LockBit Green**. By 2023, analysts reported infrastructure and leak-site reliability problems that frustrated affiliates, even as the gang remained tied to major incidents such as the Royal Mail attack. In 2024, Operation Cronos disrupted LockBit infrastructure and seized decryption keys, and U.S., U.K., and Australian authorities later sanctioned and charged Russian national **Dmitry Yuryevich Khoroshev** as the alleged leader, saying LockBit hit more than 2,500 victims in at least 120 countries, collected at least **$500 million** in ransom, and caused billions in wider losses.
Aug 15, 2026
LockBit 5.0 has emerged as the latest evolution of the notorious ransomware-as-a-service operation, introducing sophisticated encryption algorithms and advanced anti-analysis techniques that significantly complicate detection and recovery efforts for targeted organizations. The malware now employs a combination of ChaCha20-Poly1305 for file encryption and X25519 with BLAKE2b for secure key exchange, while also terminating Volume Shadow Copy Service processes to prevent system recovery. LockBit 5.0’s runtime flexibility allows it to operate even without specific parameters, and its use of advanced packing and obfuscation further hinders static analysis by security professionals. Despite increased law enforcement pressure, LockBit has sustained its position as a dominant global ransomware threat, accounting for a substantial share of attacks worldwide. The group’s operations have impacted a wide range of sectors, including IT, electronics, law firms, and religious institutions, resulting in billions of dollars in ransom payments and recovery costs. LockBit continues to leverage its dark web platform to publicly list compromised organizations and stolen data, using these tactics to pressure victims into paying ransoms.
Jun 29, 2026