LockBit Ransomware

Threat Overview

LockBit operates as a ransomware-as-a-service platform. Affiliates deploy encryptors across networks, exfiltrate sensitive data, and publish leaks to pressure victims into paying ransoms.

Attack Behavior

• Mass file encryption using hybrid AES + RSA schemes
• Shadow copy and backup service deletion
• Data exfiltration prior to encryption for double extortion
• Lateral movement via stolen credentials and RDP

Infection Methods

• Phishing attachments
• Exploited VPN or RDP endpoints
• Malicious email links
• Supply-chain compromise

Symptoms & Indicators

• Renamed files with unusual extensions
• Ransom notes on desktops
• Disabled recovery tools
• Unexpected network traffic spikes

Immediate Mitigation

• Isolate affected endpoints immediately
• Preserve forensic images before cleanup
• Notify legal and incident response teams
• Do not pay ransom without professional guidance

Removal Guidance

• Boot from clean media and scan offline
• Restore from verified offline backups
• Rebuild compromised domain controllers
• Rotate all domain credentials

Prevention Methods

• Enable behavioral ransomware protection
• Maintain immutable offline backups
• Patch edge services and disable unused RDP
• Enforce least-privilege access

Telemetry Indicators

• vssadmin delete shadows
• Mass .lockbit extension renames
• Suspicious PowerShell download cradle