LockBit (Malware Family) (original) (raw)
There is no description at this point.
2024-07-16 ⋅Sentinel LABS ⋅
NullBulge | Threat Actor Masquerades as Hacktivist Group Rebelling Against AI
AsyncRAT LockBit XWorm Nullbulge
2024-06-05 ⋅S-RM ⋅David Broom, Gavin Hull
Exmatter malware levels up: S-RM observes new variant with simultaneous remote code execution and data targeting
BlackCat BlackMatter Conti ExMatter LockBit REvil Ryuk
2024-05-07 ⋅KrebsOnSecurity ⋅Brian Krebs
U.S. Charges Russian Man as Boss of LockBit Ransomware Group
LockBit
2024-05-07 ⋅Twitter (@fs0c131y) ⋅Baptiste Robert
Tweets on LockBitSupp
LockBit
2024-05-02 ⋅calif.io ⋅Hoang Nguyen, Nhan Huynh, Thai Duong
Dissecting LOCKBIT v3 ransomware
LockBit
2024-04-03 ⋅Trend Micro ⋅Christopher Boyton
Unveiling the Fallout: Operation Cronos' Impact on LockBit Following Landmark Disruption
LockBit
2024-02-29 ⋅ANALYST1 ⋅Anastasia Sentsova, Jon DiMaggio
LockBit Takedown & Operation Cronos: A Long-Awaited PsyOps Against Ransomware
LockBit LockBit LockBit
2024-02-20 ⋅National Crime Agency ⋅National Crime Agency (NCA)
International investigation disrupts the world’s most harmful cyber crime group
LockBit LockBit LockBit
2024-02-20 ⋅Europol ⋅Europol
Law enforcement disrupt world’s biggest ransomware operation
LockBit LockBit LockBit
2024-02-20 ⋅Washington Post ⋅Leo Sands
‘World’s most harmful’ cybercriminal group disrupted in 11-nation operation
LockBit LockBit LockBit
2024-02-08 ⋅ANALYST1 ⋅Anastasia Sentsova, Jon DiMaggio
“This Forum is a Bunch of Communists and They Set Me Up”, LockBit Spills the Tea Regarding Their Recent Ban on Russian-Speaking Forums
LockBit
2023-12-22 ⋅PRODAFT ⋅PRODAFT
Smoke and Mirrors: Understanding The Workings of Wazawaka
Conti Monti Babuk Hive LockBit RagnarLocker Trigona
2023-12-20 ⋅Sophos X-Ops ⋅Mark Loman, Matt Wixey
CryptoGuard: An asymmetric approach to the ransomware battle
Akira LockBit Storm-1567
2023-11-30 ⋅EchoCTI ⋅Bilal BAKARTEPE, bixploit
LockBit 3.0 Technical Analysis Report
LockBit
2023-10-03 ⋅Luca Mella
Lighting the Exfiltration Infrastructure of a LockBit Affiliate (and more)
LockBit LockBit Conti LockBit
2023-09-07 ⋅PRODAFT ⋅PRODAFT
PTI-257 (ex-Wizard Spider) - IOCs
LockBit LockBit
2023-07-26 ⋅Talos ⋅Nicole Hoffman
Incident Response trends Q2 2023: Data theft extortion rises, while healthcare is still most-targeted vertical
BianLian Clop LockBit Royal Ransom LockBit 8Base BianLian Clop LockBit Money Message Royal Ransom
2023-06-22 ⋅Kaspersky Labs ⋅GReAT
LockBit Green and phishing that targets organizations
LockBit LockBit
2023-06-17 ⋅Github (EmissarySpider) ⋅EmissarySpider
ransomware-descendants
Babuk Conti LockBit
2023-06-14 ⋅CISA ⋅ANSSI, Australian Cyber Security Centre (ACSC), Bundesamt für Sicherheit in der Informationstechnik (BSI), Canadian Centre for Cyber Security (CCCS), CERT NZ, FBI, MS-ISAC, NCSC UK, New Zealand National Cyber Security Centre (NZ NCSC)
Understanding Ransomware Threat Actors: Lockbit
LockBit
2023-05-23 ⋅loginsoft ⋅Saharsh Agrawal
Taming the Storm: Understanding and Mitigating the Consequences of CVE-2023-27350
Clop LockBit Silence
2023-05-16 ⋅KrebsOnSecurity ⋅Brian Krebs
Russian Hacker “Wazawaka” Indicted for Ransomware
Babuk Hive LockBit LockBit Babuk Hive LockBit
2023-04-19 ⋅Bleeping Computer ⋅Bill Toulas
March 2023 broke ransomware attack records with 459 incidents
Clop WhiteRabbit BianLian Black Basta BlackCat LockBit MedusaLocker PLAY Royal Ransom
2023-04-18 ⋅Mandiant ⋅Mandiant
M-Trends 2023
QUIETEXIT AppleJeus Black Basta BlackCat CaddyWiper Cobalt Strike Dharma HermeticWiper Hive INDUSTROYER2 Ladon LockBit Meterpreter PartyTicket PlugX QakBot REvil Royal Ransom SystemBC WhisperGate
2023-04-14 ⋅ ⋅GLIMPS ⋅GLIMPS
Lockbit changes color
LockBit
2023-03-30 ⋅United States District Court (Eastern District of New York) ⋅Fortra, HEALTH-ISAC, Microsoft
Cracked Cobalt Strike (1:23-cv-02447)
Black Basta BlackCat LockBit RagnarLocker LockBit Black Basta BlackCat Cobalt Strike Cuba Emotet LockBit Mount Locker PLAY QakBot RagnarLocker Royal Ransom Zloader
2023-02-28 ⋅Fortinet ⋅Eliran Voronovitch
Can You See It Now? An Emerging LockBit Campaign
LockBit
2023-02-01 ⋅Security Affairs ⋅Pierluigi Paganini
New LockBit Green ransomware variant borrows code from Conti ransomware
Conti LockBit
2023-02-01 ⋅Seqrite ⋅Sathwik Ram Prakki
Uncovering LockBit Black’s Attack Chain and Anti-forensic activity
LockBit
2023-01-16 ⋅ANALYST1 ⋅Jon DiMaggio
Unlocking Lockbit: A Ransomware Story
LockBit LockBit
2022-11-30 ⋅Sophos ⋅Andrew Brandt
LockBit 3.0 ‘Black’ attacks and leaks reveal wormable capabilities and tooling
LockBit
2022-11-08 ⋅AhnLab ⋅ASEC
LockBit 3.0 Being Distributed via Amadey Bot
Amadey Gandcrab LockBit
2022-10-18 ⋅Logpoint ⋅Anish Bogati, Nilaa Maharjan
Hunting Lockbit Variation
LockBit
2022-10-15 ⋅vmware ⋅Dana Behling
LockBit 3.0 Ransomware Unlocked
LockBit
2022-10-11 ⋅ ⋅AhnLab ⋅ASEC Analysis Team
From Exchange Server vulnerability to ransomware infection in just 7 days
LockBit MimiKatz
2022-09-22 ⋅Cyber Geeks ⋅Vlad Pasca
A Technical Analysis Of The Leaked LOCKBIT 3.0 Builder
LockBit
2022-09-22 ⋅Medium s2wlab ⋅Jeong Hyunsik, Yang HuiSeong
Quick Overview of Leaked LockBit 3.0 (Black) builder program
LockBit
2022-08-28 ⋅BleepingComputer ⋅Ionut Ilascu
LockBit ransomware gang gets aggressive with triple-extortion tactic
LockBit
2022-08-19 ⋅nccgroup ⋅Ross Inman
Back in Black: Unlocking a LockBit 3.0 Ransomware Attack
FAKEUPDATES Cobalt Strike LockBit
2022-08-11 ⋅SecurityScorecard ⋅Robert Ames
The Increase in Ransomware Attacks on Local Governments
BlackCat BlackCat Cobalt Strike LockBit
2022-08-10 ⋅Quick Heal ⋅Sathwik Ram Prakki
Indian Power Sector targeted with latest LockBit 3.0 variant
LockBit
2022-08-04 ⋅YouTube (Arda Büyükkaya) ⋅Arda Büyükkaya
LockBit Ransomware Sideloads Cobalt Strike Through Microsoft Security Tool
Cobalt Strike LockBit
2022-07-28 ⋅SentinelOne ⋅James Haughom, Julien Reisdorffer, Júlio Dantas
Living Off Windows Defender | LockBit Ransomware Sideloads Cobalt Strike Through Microsoft Security Tool
Cobalt Strike LockBit
2022-07-25 ⋅Trend Micro ⋅Byron Gelera, Ieriz Nicolle Gonzalez, Ivan Nicole Chavez, Katherine Casona, Nathaniel Gregory Ragasa, Nathaniel Morales
LockBit Ransomware Group Augments Its Latest Variant, LockBit 3.0, With BlackMatter Capabilities
BlackMatter LockBit
2022-07-21 ⋅Sentinel LABS ⋅Aleksandar Milenkoski, Jim Walter
LockBit 3.0 Update | Unpicking the Ransomware’s Latest Anti-Analysis and Evasion Techniques
LockBit
2022-07-20 ⋅Symantec ⋅Lahu Khatal, Vishal Kamble
LockBit: Ransomware Puts Servers in the Crosshairs
LockBit
2022-07-18 ⋅Fortinet ⋅FortiGuard Labs
Ransomware Roundup: Protecting Against New Variants
LockBit LockBit
2022-07-13 ⋅ ⋅GLIMPS ⋅GLIMPS
Lockbit 3.0
BlackMatter DarkSide LockBit
2022-07-10 ⋅Minerva Labs ⋅Natalie Zargarov
Lockbit 3.0 AKA Lockbit Black is here, with a new icon, new ransom note, new wallpaper, but less evasiveness?
LockBit
2022-07-07 ⋅Cybereason ⋅Cybereason Global SOC Team
THREAT ANALYSIS REPORT: LockBit 2.0 - All Paths Lead to Ransom
LockBit
2022-07-06 ⋅Cluster25 ⋅Cluster25
LockBit 3.0: “Making The Ransomware Great Again”
LockBit
2022-07-05 ⋅cyble ⋅Cyble Research Labs
Lockbit 3.0 – Ransomware Group Launches New Version
LockBit
2022-06-24 ⋅AhnLab ⋅ASEC
LockBit Ransomware Disguised as Copyright Claim E-mail Being Distributed
LockBit
2022-06-23 ⋅Kaspersky ⋅Danila Nasonov, Natalya Shornikova, Nikita Nazarov, Vasily Davydov, Vladislav Burtsev
The hateful eight: Kaspersky’s guide to modern ransomware groups’ TTPs (Download Form)
BlackByte BlackCat Clop Conti Hive LockBit Mespinoza RagnarLocker
2022-06-23 ⋅Kaspersky ⋅Danila Nasonov, Natalya Shornikova, Nikita Nazarov, Vasily Davydov, Vladislav Burtsev
The hateful eight: Kaspersky’s guide to modern ransomware groups’ TTPs
Conti Hive BlackByte BlackCat Clop LockBit Mespinoza Ragnarok
2022-06-09 ⋅Palo Alto Networks Unit 42 ⋅Abigail Barr, Amer Elsad, JR Gumarin
LockBit 2.0: How This RaaS Operates and How to Protect Against It
LockBit
2022-06-02 ⋅Mandiant ⋅Mandiant Intelligence
To HADES and Back: UNC2165 Shifts to LOCKBIT to Evade Sanctions
FAKEUPDATES Blister Cobalt Strike DoppelPaymer Dridex FriedEx Hades LockBit Macaw MimiKatz Phoenix Locker WastedLocker
2022-06-02 ⋅Packt ⋅packtsecurity
A SecPro Super Issue: Understanding LockBit
LockBit LockBit BITWISE SPIDER
2022-05-23 ⋅Trend Micro ⋅Matsugaya Shingo
LockBit, Conti, and BlackCat Lead Pack Amid Rise in Active RaaS and Extortion Groups: Ransomware in Q1 2022
BlackCat Conti LockBit
2022-05-23 ⋅Trend Micro ⋅Trend Micro Research
LockBit, Conti, and BlackCat Lead Pack Amid Rise in Active RaaS and Extortion Groups: Ransomware in Q1 2022 (PDF)
BlackCat Conti LockBit
2022-05-11 ⋅Kaspersky ⋅GReAT
New ransomware trends in 2022
BlackCat Conti DEADBOLT DoubleZero LockBit PartyTicket StealBit
2022-05-09 ⋅Microsoft ⋅Microsoft 365 Defender Threat Intelligence Team, Microsoft Threat Intelligence Center (MSTIC)
Ransomware-as-a-service: Understanding the cybercrime gig economy and how to protect yourself
AnchorDNS BlackCat BlackMatter Conti DarkSide HelloKitty Hive LockBit REvil FAKEUPDATES Griffon ATOMSILO BazarBackdoor BlackCat BlackMatter Blister Cobalt Strike Conti DarkSide Emotet FiveHands Gozi HelloKitty Hive IcedID ISFB JSSLoader LockBit LockFile Maze NightSky Pandora Phobos Phoenix Locker PhotoLoader QakBot REvil Rook Ryuk SystemBC TrickBot WastedLocker BRONZE STARLIGHT
2022-05-09 ⋅Microsoft Security ⋅Microsoft 365 Defender Threat Intelligence Team, Microsoft Threat Intelligence Center
Ransomware-as-a-service: Understanding the cybercrime gig economy and how to protect yourself
Griffon BazarBackdoor BlackCat BlackMatter Blister Gozi LockBit Pandora Rook SystemBC TrickBot
2022-05-06 ⋅ ⋅LeMagIT ⋅Valéry Rieß-Marchive
Ransomware: LockBit 3.0 Starts Using in Cyberattacks
LockBit
2022-05-06 ⋅Twitter (@MsftSecIntel) ⋅Microsoft Security Intelligence
Twitter Thread on initial infeciton of SocGholish/ FAKEUPDATES campaigns lead to BLISTER Loader, CobaltStrike, Lockbit and followed by Hands On Keyboard activity
FAKEUPDATES Blister Cobalt Strike LockBit
2022-05-05 ⋅Intel 471 ⋅Intel 471
Cybercrime loves company: Conti cooperated with other ransomware gangs
LockBit Maze RagnarLocker Ryuk
2022-04-27 ⋅Sentinel LABS ⋅James Haughom, Jim Walter, Júlio Dantas
LockBit Ransomware Side-loads Cobalt Strike Beacon with Legitimate VMware Utility
Cobalt Strike LockBit
2022-04-27 ⋅Sentinel LABS ⋅James Haughom, Jim Walter, Júlio Dantas
LockBit Ransomware Side-loads Cobalt Strike Beacon with Legitimate VMware Utility
Cobalt Strike LockBit BRONZE STARLIGHT
2022-04-12 ⋅ConnectWise ⋅ConnectWise CRU
Threat Profile: LockBit
LockBit
2022-04-12 ⋅Sophos ⋅Andrew Brandt, Angela Gunn, Ferenc László Nagy, Johnathan Fern, Linda Smith, Matthew Everts, Mauricio Valdivieso, Melissa Kelly, Peter Mackenzie, Sergio Bestulic
Attackers linger on government agency computers before deploying Lockbit ransomware
LockBit
2022-04-06 ⋅SOCRadar ⋅SOCRadar
Lockbit 3.0: Another Upgrade to World’s Most Active Ransomware
LockBit LockBit BITWISE SPIDER
2022-04-05 ⋅Trend Micro ⋅Abdelrhman Sharshar, Earle Maui Earnshaw, Ian Kenefick, Lucas Silva, Mohamed Fahmy, Ryan Maglaque
Thwarting Loaders: From SocGholish to BLISTER’s LockBit Payload (IoCs)
FAKEUPDATES Blister LockBit
2022-04-05 ⋅Trend Micro ⋅Abdelrhman Sharshar, Earle Maui Earnshaw, Ian Kenefick, Lucas Silva, Mohamed Fahmy, Ryan Maglaque
Thwarting Loaders: From SocGholish to BLISTER’s LockBit Payload
FAKEUPDATES Blister LockBit
2022-04-05 ⋅Trend Micro ⋅Abdelrhman Sharshar, Earle Earnshaw, Ian Kenefick, Lucas Silva, Mohamed Fahmy, Ryan Maglaque
Thwarting Loaders: From SocGholish to BLISTER’s LockBit Payload
Blister LockBit
2022-04-01 ⋅Bleeping Computer ⋅Lawrence Abrams
The Week in Ransomware - April 1st 2022 - 'I can fight with a keyboard'
Hive Dharma LockBit STOP SunCrypt
2022-03-31 ⋅Bleeping Computer ⋅Bill Toulas
LockBit victim estimates cost of ransomware attack to be $42 million
LockBit LockBit
2022-03-31 ⋅Trellix ⋅Jambul Tologonov, John Fokker
Conti Leaks: Examining the Panama Papers of Ransomware
LockBit Amadey Buer Conti IcedID LockBit Mailto Maze PhotoLoader Ryuk TrickBot
2022-03-23 ⋅splunk ⋅Shannon Davis
Gone in 52 Seconds…and 42 Minutes: A Comparative Analysis of Ransomware Encryption Speed
Avaddon Babuk BlackMatter Conti DarkSide LockBit Maze Mespinoza REvil Ryuk
2022-03-19 ⋅Chuongdong blog ⋅Chuong Dong
LockBit Ransomware v2.0
LockBit
2022-03-17 ⋅Sophos ⋅Tilly Travers
The Ransomware Threat Intelligence Center
ATOMSILO Avaddon AvosLocker BlackKingdom Ransomware BlackMatter Conti Cring DarkSide dearcry Dharma Egregor Entropy Epsilon Red Gandcrab Karma LockBit LockFile Mailto Maze Nefilim RagnarLocker Ragnarok REvil RobinHood Ryuk SamSam Snatch WannaCryptor WastedLocker
2022-03-11 ⋅Bleeping Computer ⋅Ionut Ilascu
LockBit ransomware gang claims attack on Bridgestone Americas
LockBit
2022-03-11 ⋅Microsoft ⋅Microsoft Detection and Response Team (DART)
Part 1: LockBit 2.0 ransomware bugs and database recovery attempts
LockBit
2022-03-11 ⋅Microsoft ⋅Microsoft Detection and Response Team (DART)
Part 2: LockBit 2.0 ransomware bugs and database recovery attempts
LockBit
2022-02-27 ⋅The Record ⋅Catalin Cimpanu
Conti ransomware gang chats leaked by pro-Ukraine member
Conti LockBit
2022-02-23 ⋅splunk ⋅Shannon Davis, SURGe
An Empirically Comparative Analysis of Ransomware Binaries
Avaddon Babuk BlackMatter Conti DarkSide LockBit Maze Mespinoza REvil Ryuk
2022-02-14 ⋅ ⋅DR.DK ⋅Allan Nisgaard, Ingeborg Munk Toft, Kenrik Moltke, Marcel Mirzaei-Fard
Var tæt på at slukke tusindvis af vindmøller: Nu fortæller Vestas om cyberangreb
LockBit
2022-02-14 ⋅LIFARS ⋅Vlad Pasca
A Detailed Analysis of The LockBit Ransomware
LockBit LockBit
2022-02-09 ⋅Dragos ⋅Anna Skelton
Dragos ICS/OT Ransomware Analysis: Q4 2021
LockBit Conti LockBit
2022-02-08 ⋅Trend Micro ⋅Trend Micro Research
Ransomware Spotlight: LockBit
LockBit BITWISE SPIDER
2022-02-08 ⋅Intel 471 ⋅Intel 471
PrivateLoader: The first step in many malware schemes
Dridex Kronos LockBit Nanocore RAT NjRAT PrivateLoader Quasar RAT RedLine Stealer Remcos SmokeLoader STOP Tofsee TrickBot Vidar
2022-02-07 ⋅FBI ⋅FBI
CU-000162-MW: Indicators of Compromise Associated with LockBit 2.0 Ransomware
LockBit LockBit
2022-01-27 ⋅CoveWare
Ransomware as a Service Innovation Curve
Conti LockBit
2022-01-26 ⋅Intrinsec ⋅Intrinsec
ALPHV ransomware gang analysis
BlackCat LockBit
2022-01-24 ⋅Trend Micro ⋅Junestherry Dela Cruz
Analysis and Impact of LockBit Ransomware’s First Linux and VMware ESXi Variant
LockBit LockBit
2022-01-21 ⋅CrowdStrike ⋅Falcon OverWatch Team
Better Together: The Power of Managed Cybersecurity Services in the Face of Pressing Global Security Challenges
LockBit LockBit BITWISE SPIDER
2021-12-16 ⋅Cybereason ⋅Aleksandar Milenkoski, Kotaro Ogino
Inside the LockBit Arsenal - The StealBit Exfiltration Tool
LockBit StealBit
2021-11-23 ⋅Morphisec ⋅Arnold Osipov, Hido Cohen
Babadeda Crypter targeting crypto, NFT, and DeFi communities
Babadeda BitRAT LockBit Remcos
2021-11-18 ⋅Red Canary ⋅The Red Canary Team
Intelligence Insights: November 2021
Andromeda Conti LockBit QakBot Squirrelwaffle
2021-11-18 ⋅Cisco ⋅Josh Pyorre
BlackMatter, LockBit, and THOR
BlackMatter LockBit PlugX
2021-11-17 ⋅CrowdStrike ⋅Liviu Arsene, Sarang Sonawane, Thomas Moses
Ransomware (R)evolution Plagues Organizations, But CrowdStrike Protection Never Wavers
LockBit
2021-11-03 ⋅Bleeping Computer ⋅Lawrence Abrams
BlackMatter ransomware moves victims to LockBit after shutdown
BlackMatter BlackMatter LockBit
2021-10-27 ⋅ ⋅MBSD ⋅MBSD
ランサムウェア「LockBit2.0」の内部構造を紐
LockBit
2021-10-15 ⋅skyblue.team blog ⋅skyblue team
Recovering registry hives encrypted by LockBit 2.0
LockBit
2021-10-12 ⋅CrowdStrike ⋅CrowdStrike Intelligence Team
ECX: Big Game Hunting on the Rise Following a Notable Reduction in Activity
Babuk BlackMatter DarkSide REvil Avaddon Babuk BlackMatter DarkSide LockBit Mailto REvil
2021-10-05 ⋅Seguranca Informatica ⋅Pedro Tavares
Malware analysis: Details on LockBit ransomware
LockBit
2021-09-24 ⋅Yoroi ⋅Luca Mella, Luigi Martire
Hunting the LockBit Gang's Exfiltration Infrastructures
LockBit StealBit
2021-09-09 ⋅IBM ⋅Megan Roddie
LockBit 2.0: Ransomware Attacks Surge After Successful Affiliate Recruitment
LockBit
2021-08-26 ⋅Advanced Intelligence ⋅Anastasia Sentsova
From Russia With… LockBit Ransomware: Inside Look & Preventive Solutions
LockBit
2021-08-24 ⋅Palo Alto Networks Unit 42 ⋅Doel Santos, Ruchna Nigam
Ransomware Groups to Watch: Emerging Threats
HelloKitty AvosLocker HelloKitty Hive LockBit
2021-08-24 ⋅KELA ⋅KELA Cyber Intelligence Center
LockBit 2.0 Interview with Russian OSINT
LockBit
2021-08-17 ⋅Amged Wagih
LockBit Ransomware - Technical Anlysis
LockBit
2021-08-17 ⋅Medium amgedwageh ⋅Amged Wageh
LockBit Ransomware Analysis Notes
LockBit
2021-08-16 ⋅Trend Micro ⋅Byron Gelera, Cris Tomboc, Jayson Chong, Jett Paulo Bernardo, Mark Marti, Nikki Madayag, Sean Torre
LockBit Resurfaces With Version 2.0 Ransomware Detections in Chile, Italy, Taiwan, UK
LockBit
2021-08-16 ⋅cyble ⋅Cyble
A Deep-dive Analysis of LOCKBIT 2.0
LockBit
2021-08-15 ⋅Symantec ⋅Threat Hunter Team
The Ransomware Threat
Babuk BlackMatter DarkSide Avaddon Babuk BADHATCH BazarBackdoor BlackMatter Clop Cobalt Strike Conti DarkSide DoppelPaymer Egregor Emotet FiveHands FriedEx Hades IcedID LockBit Maze MegaCortex MimiKatz QakBot RagnarLocker REvil Ryuk TrickBot WastedLocker
2021-08-12 ⋅Netskope ⋅Gustavo Palazolo
Netskope Threat Coverage: LockBit
LockBit
2021-08-11 ⋅Cybereason ⋅Tony Bradley
The Rising Threat from LockBit Ransomware
LockBit
2021-08-06 ⋅The Record ⋅Catalin Cimpanu
Australian cybersecurity agency warns of spike in LockBit ransomware attacks
LockBit
2021-08-04 ⋅Bleeping Computer ⋅Sergiu Gatlan
Energy group ERG reports minor disruptions after ransomware attack
LockBit
2021-08-04 ⋅Bleeping Computer ⋅Lawrence Abrams
LockBit ransomware recruiting insiders to breach corporate networks
LockBit
2021-08-03 ⋅Bleeping Computer ⋅Lawrence Abrams
Ransomware attack hits Italy's Lazio region, affects COVID-19 site
LockBit RansomEXX
2021-08-02 ⋅The Record ⋅Dmitry Smilyanets
An interview with BlackMatter: A new ransomware group that’s learning from the mistakes of DarkSide and REvil
DarkSide LockBit REvil
2021-07-27 ⋅Bleeping Computer ⋅Lawrence Abrams
LockBit ransomware now encrypts Windows domains using group policies
Egregor LockBit
2021-07-27 ⋅Recorded Future ⋅Insikt Group®
BlackMatter Ransomware Emerges As Successor to DarkSide, REvil
DarkSide LockBit REvil
2021-07-22 ⋅S2W LAB Inc. ⋅Denise Dasom Kim, Jungyeon Lim, Sujin Lim, Yeonghyeon Jeong
W4 July | EN | Story of the week: Ransomware on the Darkweb
LockBit SunCrypt
2021-06-18 ⋅PRODAFT Threat Intelligence ⋅PRODAFT
LockBit RaaS In-Depth Analysis
LockBit
2021-05-13 ⋅Bleeping Computer ⋅Lawrence Abrams
Popular Russian hacking forum XSS bans all ransomware topics
DarkSide DarkSide LockBit REvil
2021-05-10 ⋅DarkTracer ⋅DarkTracer
Intelligence Report on Ransomware Gangs on the DarkWeb: List of victim organizations attacked by ransomware gangs released on the DarkWeb
RansomEXX Avaddon Babuk Clop Conti Cuba DarkSide DoppelPaymer Egregor Hades LockBit Mailto Maze MedusaLocker Mespinoza Mount Locker Nefilim Nemty Pay2Key PwndLocker RagnarLocker Ragnarok RansomEXX REvil Sekhmet SunCrypt ThunderX
2021-05-06 ⋅Cyborg Security ⋅Brandon Denker
Ransomware: Hunting for Inhibiting System Backup or Recovery
Avaddon Conti DarkSide LockBit Mailto Maze Mespinoza Nemty PwndLocker RagnarLocker RansomEXX REvil Ryuk Snatch ThunderX
2021-04-28 ⋅Bleeping Computer ⋅Lawrence Abrams
UK rail network Merseyrail likely hit by Lockbit ransomware
LockBit
2021-04-26 ⋅CoveWare ⋅CoveWare
Ransomware Attack Vectors Shift as New Software Vulnerability Exploits Abound
Avaddon Clop Conti DarkSide Egregor LockBit Mailto Phobos REvil Ryuk SunCrypt
2021-04-07 ⋅ANALYST1 ⋅Jon DiMaggio
Ransom Mafia Analysis of the World's First Ransomware Cartel
Conti Egregor LockBit Maze RagnarLocker Ryuk SunCrypt TA2101 VIKING SPIDER
2021-04-07 ⋅ANALYST1 ⋅Jon DiMaggio
Ransom Mafia - Analysis of the World's First Ransomware Cartel
Conti Egregor LockBit Maze RagnarLocker SunCrypt VIKING SPIDER
2021-03-17 ⋅The Record ⋅Catalin Cimpanu
Missed opportunity: Bug in LockBit ransomware allowed free decryptions
LockBit
2021-02-23 ⋅CrowdStrike ⋅CrowdStrike
2021 Global Threat Report
RansomEXX Amadey Anchor Avaddon BazarBackdoor Clop Cobalt Strike Conti Cutwail DanaBot DarkSide DoppelPaymer Dridex Egregor Emotet Hakbit IcedID JSOutProx KerrDown LockBit Mailto Maze MedusaLocker Mespinoza Mount Locker NedDnLoader Nemty Pay2Key PlugX Pushdo PwndLocker PyXie QakBot Quasar RAT RagnarLocker Ragnarok RansomEXX REvil Ryuk Sekhmet ShadowPad SmokeLoader Snake SUNBURST SunCrypt TEARDROP TrickBot WastedLocker Winnti Zloader Evilnum OUTLAW SPIDER RIDDLE SPIDER SOLAR SPIDER VIKING SPIDER
2021-01-26 ⋅Medium s2wlab ⋅Hyunmin Suh
W4 Jan | EN | Story of the week: Ransomware on the Darkweb
Avaddon Babuk LockBit
2021-01-04 ⋅Cisco Talos ⋅Azim Khodjibaev, Dmytro Korzhevin, Kendall McKay
Interview with a LockBit ransomware operator
LockBit
2020-12-05 ⋅ZDNet ⋅Catalin Cimpanu
Ransomware hits helicopter maker Kopter
LockBit
2020-11-18 ⋅KELA ⋅Victoria Kivilevich
Zooming into Darknet Threats Targeting Japanese Organizations
Conti DoppelPaymer Egregor LockBit Maze REvil Snake
2020-10-21 ⋅SophosLabs Uncut ⋅Sean Gallagher
LockBit uses automated attack tools to identify tasty targets
LockBit
2020-10-02 ⋅Lexfo ⋅Lexfo
Lockbit analysis
LockBit
2020-09-25 ⋅CrowdStrike ⋅The Crowdstrike Intel Team
Double Trouble: Ransomware with Data Leak Extortion, Part 1
DoppelPaymer FriedEx LockBit Maze MedusaLocker RagnarLocker REvil RobinHood SamSam WastedLocker MIMIC SPIDER PIZZO SPIDER TA2101 VIKING SPIDER
2020-09-24 ⋅CrowdStrike ⋅CrowdStrike Intelligence Team
Double Trouble: Ransomware with Data Leak Extortion, Part 1
DoppelPaymer Gandcrab LockBit Maze MedusaLocker RagnarLocker SamSam OUTLAW SPIDER OVERLORD SPIDER
2020-09-17 ⋅CRYPSIS ⋅Drew Schmitt
Ransomware’s New Trend: Exfiltration and Extortion
LockBit
2020-09-01 ⋅Cisco Talos ⋅Caitlin Huey, David Liebenberg
Quarterly Report: Incident Response trends in Summer 2020
Cobalt Strike LockBit Mailto Maze Ryuk
2020-07-29 ⋅ESET Research ⋅welivesecurity
THREAT REPORT Q2 2020
DEFENSOR ID HiddenAd Bundlore Pirrit Agent.BTZ Cerber ClipBanker CROSSWALK Cryptowall CTB Locker DanaBot Dharma Formbook Gandcrab Grandoreiro Houdini ISFB LockBit Locky Mailto Maze Microcin Nemty NjRAT Phobos PlugX Pony REvil Socelars STOP Tinba TrickBot WannaCryptor
2020-04-28 ⋅Microsoft ⋅Microsoft Threat Protection Intelligence Team
Ransomware groups continue to target healthcare, critical services; here’s how to reduce risk
LockBit Mailto Maze MedusaLocker Paradise RagnarLocker REvil RobinHood
2020-04-24 ⋅Github (albertzsigovits) ⋅Albert Zsigovits
LockBit ransomware IoCs
LockBit
2020-04-24 ⋅Sophos Labs ⋅Albert Zsigovits
LockBit ransomware borrows tricks to keep up with REvil and Maze
LockBit
[TLP:WHITE] win_lockbit_auto (20241030 | Detects win.lockbit.)
rule win_lockbit_auto {
meta:
author = "Felix Bilstein - yara-signator at cocacoding dot com"
date = "2024-10-31"
version = "1"
description = "Detects win.lockbit."
info = "autogenerated rule brought to you by yara-signator"
tool = "yara-signator v0.6.0"
signator_config = "callsandjumps;datarefs;binvalue"
malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lockbit"
malpedia_rule_date = "20241030"
malpedia_hash = "26e26953c49c8efafbf72a38076855d578e0a2e4"
malpedia_version = "20241030"
malpedia_license = "CC BY-SA 4.0"
malpedia_sharing = "TLP:WHITE"
/* DISCLAIMER
* The strings used in this rule have been automatically selected from the
* disassembly of memory dumps and unpacked files, using YARA-Signator.
* The code and documentation is published here:
* https://github.com/fxb-cocacoding/yara-signator
* As Malpedia is used as data source, please note that for a given
* number of families, only single samples are documented.
* This likely impacts the degree of generalization these rules will offer.
* Take the described generation method also into consideration when you
* apply the rules in your use cases and assign them confidence levels.
*/
strings:
$sequence_0 = { 49 8bc1 5f 59 5d }
// n = 5, score = 300
// 49 | dec ecx
// 8bc1 | mov eax, ecx
// 5f | pop edi
// 59 | pop ecx
// 5d | pop ebp
$sequence_1 = { c20800 33c0 40 c1e006 }
// n = 4, score = 300
// c20800 | ret 8
// 33c0 | xor eax, eax
// 40 | inc eax
// c1e006 | shl eax, 6
$sequence_2 = { 4f 85ff 75c1 5f }
// n = 4, score = 300
// 4f | dec edi
// 85ff | test edi, edi
// 75c1 | jne 0xffffffc3
// 5f | pop edi
$sequence_3 = { 8d45f8 50 8d45fc 50 ff75fc ff75f4 }
// n = 6, score = 300
// 8d45f8 | lea eax, [ebp - 8]
// 50 | push eax
// 8d45fc | lea eax, [ebp - 4]
// 50 | push eax
// ff75fc | push dword ptr [ebp - 4]
// ff75f4 | push dword ptr [ebp - 0xc]
$sequence_4 = { 03d0 90 85c0 75e1 8bc2 5e 5a }
// n = 7, score = 300
// 03d0 | add edx, eax
// 90 | nop
// 85c0 | test eax, eax
// 75e1 | jne 0xffffffe3
// 8bc2 | mov eax, edx
// 5e | pop esi
// 5a | pop edx
$sequence_5 = { 33c0 8d7df0 33c9 53 0fa2 8bf3 5b }
// n = 7, score = 300
// 33c0 | xor eax, eax
// 8d7df0 | lea edi, [ebp - 0x10]
// 33c9 | xor ecx, ecx
// 53 | push ebx
// 0fa2 | cpuid
// 8bf3 | mov esi, ebx
// 5b | pop ebx
$sequence_6 = { 8b7508 b961000000 66ad 90 6683f841 720b 6683f85a }
// n = 7, score = 300
// 8b7508 | mov esi, dword ptr [ebp + 8]
// b961000000 | mov ecx, 0x61
// 66ad | lodsw ax, word ptr [esi]
// 90 | nop
// 6683f841 | cmp ax, 0x41
// 720b | jb 0xd
// 6683f85a | cmp ax, 0x5a
$sequence_7 = { 83ec10 53 56 57 33c0 8d7df0 33c9 }
// n = 7, score = 300
// 83ec10 | sub esp, 0x10
// 53 | push ebx
// 56 | push esi
// 57 | push edi
// 33c0 | xor eax, eax
// 8d7df0 | lea edi, [ebp - 0x10]
// 33c9 | xor ecx, ecx
$sequence_8 = { f745f800000002 740c 5f 5e b801000000 5b }
// n = 6, score = 300
// f745f800000002 | test dword ptr [ebp - 8], 0x2000000
// 740c | je 0xe
// 5f | pop edi
// 5e | pop esi
// b801000000 | mov eax, 1
// 5b | pop ebx
$sequence_9 = { 33d0 8bc1 c1e810 0fb6c0 c1e208 }
// n = 5, score = 300
// 33d0 | xor edx, eax
// 8bc1 | mov eax, ecx
// c1e810 | shr eax, 0x10
// 0fb6c0 | movzx eax, al
// c1e208 | shl edx, 8
$sequence_10 = { 720b 6683f85a 7705 6683c820 90 02f1 }
// n = 6, score = 300
// 720b | jb 0xd
// 6683f85a | cmp ax, 0x5a
// 7705 | ja 7
// 6683c820 | or ax, 0x20
// 90 | nop
// 02f1 | add dh, cl
$sequence_11 = { 2d04040404 49 75f4 8b7d0c be40000000 33db 55 }
// n = 7, score = 300
// 2d04040404 | sub eax, 0x4040404
// 49 | dec ecx
// 75f4 | jne 0xfffffff6
// 8b7d0c | mov edi, dword ptr [ebp + 0xc]
// be40000000 | mov esi, 0x40
// 33db | xor ebx, ebx
// 55 | push ebp
$sequence_12 = { 8d8550fdffff 50 6a00 ff15???????? }
// n = 4, score = 300
// 8d8550fdffff | lea eax, [ebp - 0x2b0]
// 50 | push eax
// 6a00 | push 0
// ff15???????? |
$sequence_13 = { 8bf3 5b 8907 897704 894f08 89570c f745f800000002 }
// n = 7, score = 300
// 8bf3 | mov esi, ebx
// 5b | pop ebx
// 8907 | mov dword ptr [edi], eax
// 897704 | mov dword ptr [edi + 4], esi
// 894f08 | mov dword ptr [edi + 8], ecx
// 89570c | mov dword ptr [edi + 0xc], edx
// f745f800000002 | test dword ptr [ebp - 8], 0x2000000
$sequence_14 = { 8d45f4 50 6a00 6a00 ff15???????? }
// n = 5, score = 300
// 8d45f4 | lea eax, [ebp - 0xc]
// 50 | push eax
// 6a00 | push 0
// 6a00 | push 0
// ff15???????? |
$sequence_15 = { e8???????? 85c0 7502 eb59 8d3c47 6a00 }
// n = 6, score = 300
// e8???????? |
// 85c0 | test eax, eax
// 7502 | jne 4
// eb59 | jmp 0x5b
// 8d3c47 | lea edi, [edi + eax*2]
// 6a00 | push 0
$sequence_16 = { 0f28c8 660f73f904 660fefc8 0f28c1 660f73f804 660fefc1 }
// n = 6, score = 300
// 0f28c8 | movaps xmm1, xmm0
// 660f73f904 | pslldq xmm1, 4
// 660fefc8 | pxor xmm1, xmm0
// 0f28c1 | movaps xmm0, xmm1
// 660f73f804 | pslldq xmm0, 4
// 660fefc1 | pxor xmm0, xmm1
$sequence_17 = { 6a00 6a00 6800000040 ff75d4 }
// n = 4, score = 300
// 6a00 | push 0
// 6a00 | push 0
// 6800000040 | push 0x40000000
// ff75d4 | push dword ptr [ebp - 0x2c]
$sequence_18 = { 7413 83e910 660f6f0c0e 660f3a0fc10f 660f7f040f }
// n = 5, score = 200
// 7413 | je 0x15
// 83e910 | sub ecx, 0x10
// 660f6f0c0e | movdqa xmm1, xmmword ptr [esi + ecx]
// 660f3a0fc10f | palignr xmm0, xmm1, 0xf
// 660f7f040f | movdqa xmmword ptr [edi + ecx], xmm0
$sequence_19 = { 234df0 094ddc 0155dc 8b55f4 8bf2 c1ce0b 8bca }
// n = 7, score = 200
// 234df0 | and ecx, dword ptr [ebp - 0x10]
// 094ddc | or dword ptr [ebp - 0x24], ecx
// 0155dc | add dword ptr [ebp - 0x24], edx
// 8b55f4 | mov edx, dword ptr [ebp - 0xc]
// 8bf2 | mov esi, edx
// c1ce0b | ror esi, 0xb
// 8bca | mov ecx, edx
condition:
7 of them and filesize < 2049024}