Article
International Agencies Unmasked LockBit Ransomware Group Leader
The LockBit ransomware leader was named as Dmitry Khoroshev in May 2024. See the sanctions, the $10 million reward and what the sources say…
Read more
Ransomware group profile
LockBit
Also known as LockBit 2.0 (LockBit Red), LockBit 3.0 (LockBit Black), LockBit Green
LockBit is a ransomware as a service operation first seen in January 2020.
- Disrupted
In short
LockBit is a ransomware as a service operation first seen in January 2020. A joint advisory (AA23-165A, June 14, 2023) calls it the most deployed ransomware variant in the world in 2022. The UK National Crime Agency took control of its services in February 2024 and, in May 2024, assessed the group as running at limited capacity.
- StatusDisruptedas reported
- Other Names3names in public reportsLockBit 2.0 (LockBit Red) · LockBit 3.0 (LockBit Black) · LockBit Green
- Entry Routes5ways inRemote Desktop Protocol (RDP) · Phishing and spearphishing · Stolen or reused accounts
- Techniques6mapped to MITRE ATT&CKDrive-by Compromise · External Remote Services
- Defences7first steps listedRequire phishing-resistant MFA · Segment the network
Overview
LockBit is a ransomware as a service (RaaS) operation. Its developers supply the malware and the tools. Affiliates, the people who break into networks, run the attacks. A joint advisory (AA23-165A, June 14, 2023) from the US, Australia, Canada, the UK, France, Germany and New Zealand says LockBit was the most deployed ransomware variant in the world in 2022 and was still prolific in 2023.
Scale as officials state it
The advisory says affiliates have attacked organizations of every size since January 2020, across financial services, food and agriculture, education, energy, government and emergency services, healthcare, manufacturing and transportation. The FBI counted about 1,700 LockBit attacks in the US since 2020 and about 91 million US dollars paid in US ransoms. Australia put LockBit at 18% of its reported ransomware incidents (April 2022 to March 2023), and Canada at 22% in 2022.
After the 2024 operation, the UK National Crime Agency (NCA) said data from LockBit systems showed more than 7,000 attacks were built with its services between June 2022 and February 2024. The top five countries hit were the US, UK, France, Germany and China.
What made it distinct
The advisory says LockBit recruited affiliates by letting them collect the ransom first and send the core group its cut afterwards, and by offering a point-and-click interface that needs little skill. It also grew fast. Version 2.0 arrived in June 2021 with a built-in data stealing tool, a Linux and VMware ESXi version followed in October 2021, and version 3.0 in March 2022. A leaked builder let non-LockBit affiliates use version 3.0 from September 2022.
Because affiliates are unconnected, their methods differ. The advisory lists RDP, phishing, stolen accounts, drive-by downloads and flaws such as Log4j (CVE-2021-44228), GoAnywhere (CVE-2023-0669) and PaperCut (CVE-2023-27350). Tools include Mimikatz, Impacket, PsExec, Cobalt Strike and Rclone for copying data out.
Law-enforcement action
On 20 February 2024 the NCA announced it had taken control of LockBit’s main administration environment and its leak site, in an FBI-supported taskforce called Operation Cronos with partners from nine other countries. It said 28 affiliate servers were taken down, two actors were arrested in Poland and Ukraine, over 200 cryptocurrency accounts were frozen and over 1,000 decryption keys were obtained. On 7 May 2024 the UK, US and Australia sanctioned Russian national Dmitry Khoroshev, whom the NCA names as the group’s administrator and developer, and the US unsealed an indictment and offered a reward of up to 10 million US dollars. These are allegations by those authorities.
The NCA assessed that LockBit was then running at limited capacity. It said monthly UK attacks fell 73% after February and active affiliates fell to 69. It also said LockBit did not routinely delete stolen data after a ransom was paid.
- September 2019Predecessor seenFirst activity of ABCD ransomware, the predecessor, per the advisory.
- January 2020LockBit appearsLockBit-named ransomware first seen on Russian-language cybercrime forums.
- June 2021LockBit 2.0A second version appears with a built-in data stealing tool.
- March 2022LockBit 3.0The third version shares similarities with BlackMatter and Alphv ransomware, per the advisory.
- June 14, 2023AdvisoryJoint advisory AA23-165A published.
- February 20, 2024Operation CronosThe NCA announces it has taken control of LockBit’s services.
- May 7, 2024SanctionsThe NCA announces sanctions and an indictment against the alleged leader.
- First seen
- January 2020 (predecessor September 2019)
- Model
- Ransomware as a service
- Main advisory
- AA23-165A, June 14, 2023
- US attacks
- About 1,700 (FBI)
- US ransoms paid
- About 91 million USD
- Disruption
- Operation Cronos, 20 February 2024
- NCA view, May 2024
- Running at limited capacity
Also known as
- LockBit 2.0 (LockBit Red)
- LockBit 3.0 (LockBit Black)
- LockBit Green
How they get in
-
01
Remote Desktop Protocol (RDP)
Affiliates exploit RDP to gain access to victims' networks.
-
02
Phishing and spearphishing
Emails are used to gain access to victims' networks.
-
03
Stolen or reused accounts
Affiliates obtain and abuse credentials of existing accounts as a way in.
-
04
Exploited public-facing software
The advisory names CVE-2021-44228 (Log4j), CVE-2023-0669 (GoAnywhere file transfer), CVE-2023-27350 (PaperCut), CVE-2021-22986 (F5 BIG-IP) and others.
-
05
Drive-by download
A user visiting a website in the course of normal browsing is infected.
How they extort
Double extortion, per the advisory: affiliates encrypt data and also copy it out, then threaten to post it on leak sites. The advisory says leak sites show only part of the real victim count. The NCA says LockBit did not routinely delete stolen data after a ransom was paid.
Who they target
-
01
Financial services
See the industry page -
02
Education
See the industry page -
03
Energy
See the industry page -
04
Government and emergency services
See the industry page -
05
Healthcare
See the industry page -
06
Manufacturing
See the industry page
Countries
- Country Australia Australia faces state-linked espionage, ransomware and large-scale customer data theft. Asia Pacific
- Country Canada Canada faces state espionage, ransomware against hospitals, governments and critical infrastructure, and pro-Russia denial of service campaigns. North America
- Country Indonesia Indonesia is a large digital economy where cyber risk is shaped by ransomware, data leaks and fraud against banks and public bodies. Asia Pacific
- Country Italy Italy faces ransomware, DDoS campaigns by pro-Russian groups and data exposure. Europe
- Country Poland Poland faces cyber threats from state-linked actors such as APT28, Sandworm and Dragonfly, and from ransomware families such as LockBit. Europe
- Country United Kingdom The United Kingdom faces cyber threats from states and from ransomware crews. Europe
Tools and malware
- Malware Cobalt Strike Cobalt Strike is a commercial remote access tool sold for adversary simulation, which means security teams use it to test their own networks. Legitimate tool abused · Since 2012 · Linux, macOS, Windows
- Malware Impacket Impacket is a free, open source set of Python modules for working with network protocols. Legitimate tool abused · Linux, macOS, Windows
- Malware Mimikatz Mimikatz is a tool that pulls Windows account logins and passwords out of a computer. Legitimate tool abused · Since 2007 · Windows
Techniques
- Technique Data Encrypted for Impact Data Encrypted for Impact is when attackers encrypt files or whole systems so the owner can no longer use them, and then hold back the key. T1486 · Impact
- Technique Drive-by Compromise Drive-by Compromise is a way for attackers to gain access to a computer when a person visits a website during normal browsing. T1189 · Initial Access
- Technique Exploit Public-Facing Application Exploit Public-Facing Application is when an attacker abuses a weakness in a system that is reachable from the Internet to get into a network. T1190 · Initial Access
- Technique External Remote Services External Remote Services is a technique where an attacker uses a remote access service that faces the internet, such as a VPN or Citrix, to enter a network or to keep access to it. T1133 · Persistence, Initial Access
- Technique Phishing (T1566): ATT&CK Technique Phishing is when an attacker sends a message that tricks someone into opening a malicious file, following a link or giving away a password. T1566 · Initial Access
- Technique Valid Accounts Valid Accounts means an attacker logs in with real credentials that were stolen or bought. T1078 · Stealth, Persistence, Privilege Escalation, Initial Access
Vulnerabilities they exploit
- Vulnerability Citrix Bleed (CVE-2023-4966) CVE-2023-4966, nicknamed Citrix Bleed, is a flaw in NetScaler ADC and NetScaler Gateway, the Citrix products that give staff remote access. CVE-2023-4966 · Citrix (Cloud Software Group) · Sensitive information disclosure (buffer-related memory leak, CWE-119)
- Vulnerability GoAnywhere MFT remote code execution (CVE-2023-0669) CVE-2023-0669 is a flaw in GoAnywhere MFT, a managed file transfer product from Fortra. CVE-2023-0669 · Fortra (formerly HelpSystems) · Pre-authentication command injection in the License Response Servlet, caused by deserializing an attacker-controlled object
- Vulnerability PaperCut NG and MF authentication bypass (CVE-2023-27350) CVE-2023-27350 is a flaw in PaperCut NG and PaperCut MF, print management software. CVE-2023-27350 · PaperCut · Improper access control in the SetupCompleted class, leading to authentication bypass and remote code execution
Notable incidents
How to defend
-
Patch exposed systems within 24 to 48 hours
The advisory says to patch vulnerable software and hardware within 24 to 48 hours of disclosure, starting with known exploited flaws in internet-facing systems.
-
Require phishing-resistant MFA
Use it for all services where possible, especially webmail, VPNs and privileged accounts.
-
Use long passwords and lockouts
At least 15 characters, block known-compromised passwords, and lock accounts after repeated failed logins.
-
Segment the network
Controlling traffic between subnetworks limits how far ransomware can spread.
-
Block direct internet access to admin interfaces
Close or restrict exposed remote services such as RDP and VPN to those who need them.
-
Train staff on phishing
Give practical training, because phishing is one of the main infection routes.
-
Keep offline, tested backups
Keep copies in a separate, secure place and practise restoring them.
Questions
What is LockBit ransomware?
LockBit is a ransomware as a service operation first seen in January 2020. Its developers supply the malware and tools, and affiliates, the people who break into networks, run the attacks. A joint advisory (AA23-165A) calls it the most deployed ransomware variant in the world in 2022.
How does LockBit get into networks?
Because LockBit affiliates are unconnected, their methods differ. The advisory lists Remote Desktop Protocol, phishing, stolen accounts, drive-by downloads and flaws such as Log4j, GoAnywhere and PaperCut. Tools seen include Mimikatz, Impacket, PsExec, Cobalt Strike and Rclone.
Was LockBit shut down?
On 20 February 2024 the UK National Crime Agency announced it had taken control of LockBit's main administration environment and leak site in Operation Cronos. In May 2024 it assessed the group as running at limited capacity. The page lists LockBit's status as disrupted.
Which sectors did LockBit attack?
The advisory says affiliates attacked organizations of every size since January 2020. Sectors named include financial services, food and agriculture, education, energy, government and emergency services, healthcare, manufacturing and transportation.
In our research
- International Agencies Unmasked LockBit Ransomware Group Leader May 2024
- LockBit 3.0 Technical Analysis Report October 2023
- LockBit 3.0 Technical Analysis Report September 2022
- LockBit Threat Actors Release LockBit 3.0 with New “Bug Bounty” Program June 2022
- Ransomware examples: attacks, types and groups October 2026
- NCSC Annual Review 2025: UK Cyber Threat Findings October 2026
Sources
- Understanding Ransomware Threat Actors: LockBit (AA23-165A) CISA, FBI, MS-ISAC and international partners
- International investigation disrupts the world's most harmful cyber crime group UK National Crime Agency
- LockBit leader unmasked and sanctioned UK National Crime Agency
- LockBit 3.0, Software S1202 MITRE ATT&CK
- LockBit 2.0, Software S1199 MITRE ATT&CK
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.