LockBit 3.0 Ransomware
Recovery Services

What is LockBit 3.0 Ransomware?

LockBit initially surfaced in September 2019, followed by the release of LockBit 2.0 in 2021. Subsequently, in June 2022, it underwent a rebranding process, adopting the name LockBit 3.0, also known as LockBit Black.

LockBit stands out as the leading Ransomware-as-a-Service group, demonstrating remarkable success in deploying tactics like double-extortion and collaborating with initial access broker affiliates. Driven solely by financial gain, LockBit primarily targets critical infrastructure, focusing on organizations within key sectors such as healthcare, IT, education, and manufacturing. Affiliates deploying LockBit 3.0 use varying TTPs; remote desktop protocol, exploitation of public-facing applications, and impactful data encryption. Most of LockBit’s targets are US companies (50%) and the rest of the targets seem to be NATO member countries such as France (11%) and the UK (7%).

Distinguishing itself from its predecessor, LockBit 3.0 introduces a notable feature – the capacity to customize multiple options throughout both the compilation and execution phases of the payload. Employing a modular approach, LockBit 3.0 encrypts the payload until execution, thereby creating substantial hurdles for the analysis and detection of malware. Ransom payments are split between the LockBit developer team and the attacking affiliates, who receive up to ¾ of the ransom funds. 

How Does LockBit 3.0 Ransomware Operate?

LockBit employs a multi-faceted attack approach, including phishing, exploitation of RDP and VPN access, ransomware deployment, data exfiltration, and double extortion. The ransomware payload, utilizing AES and RSA encryption, encrypts files and network shares. To expedite processing, it encrypts only the initial few KB of each file and appends a “.lockbit” extension. Additionally, LockBit replaces the desktop wallpaper with a ransom note, seeking to recruit affiliates. 

An exceptional feature of LockBit is its autonomous spreading ability, distinguishing it from many ransomware attacks that rely on manual navigation within a network over extended periods for reconnaissance and surveillance. Once a single host is manually infected by the attacker, LockBit autonomously identifies other accessible hosts, establishes connections with infected ones, and propagates the infection using a scripted process. Remarkably, this entire sequence occurs without human intervention. Moreover, LockBit strategically employs tools (Windows Powershell and SMB) commonly found in Windows computer systems, making it challenging for endpoint security systems to detect malicious activity. To further deceive system defenses, it conceals the executable encrypting file by disguising it as a common .PNG image format.

How Can You Protect Your Company Against LockBit 3.0 Ransomware?

LockBit 3.0 is extensively active and employs a variety of tactics, techniques, and procedures, facilitated by its extensive network of affiliates. There’s a high likelihood of the number of victims and potential targets increasing, leading to a notable rise in LockBit attacks in the near future, especially if it succeeds in becoming the first significant ransomware affecting iOS devices. LockBit’s broad targeting across multiple countries and sectors, along with its efforts to expand the range of systems it can infect, underscore the significant threat it poses to all organizations. Organizations must be vigilant and mitigate risk by using strong passwords, multi-factor authentication, and cybersecurity solutions. 

Other ways organizations can protect themselves from LockBit 3.0: 

1. Deactivate unused user accounts
2. Limit user account permission
3. Update outdated policies. Patch all systems regularly. Conduct security audits regularly to look for vulnerabilities 
4. Set up multiple system backups and implement a recovery plan 
5. Follow all security procedures
6. Monitor network traffic and look for IOCs 
7. Educate and train employees on cybersecurity practices 

Regular maintenance is required to ensure the relevance of these proactive measures. 

CISA- Understanding Ransomware Threat Actors: LockBit 

CISA – #StopRansomware: LockBit 3.0

If you’re the victim of a LockBit 3.0 ransomware attack, contact us today at (949) 428-5001 for a fast and effective recovery!