Lockbit
| RaaS
LockBit is one of the most prolific ransomware groups in history, operating as a full RaaS platform that at its peak accounted for an estimated 44% of all ransomware incidents globally in 2023, targeting virtually every sector worldwide through an affiliate model where developers maintain infrastructure and affiliates conduct intrusions.
Victims
5
First Discovered
2020-10-21
victim
Last Discovered
2021-08-23
victim
Inactive Since
4yrs
more than
Avg Delay
N/A
attack→claim
Infostealer
N/A
victims with domain
Countries
4
hit
Known Locations (1)
| Favicon | Title | Type | Available | Last Visit | Server Info | FQDN | |
|---|---|---|---|---|---|---|---|
|
No | 2026-05-27T10:37:54 |
lockbitkodidilol.onion
|
Target
Top 5 Activity Sectors
- Transportation 2
- Technology 2
- Manufacturing 1
Top 5 Countries
-
Thailand
1
-
United Kingdom
1
-
Switzerland
1
-
India
1
Heatmap
Vulnerabilities Exploited (8)
| Vendor | Product | CVE | Source |
|---|---|---|---|
| Apache | Log4j | CVE-2021-44228 | cisa.gov |
| F5 | iControl REST | CVE-2021-22986 | cisa.gov |
| Windows | Remote Desktop Services | CVE-2019-0708 | cisa.gov |
| Citrix | NetScaler ADC & Gateway | CVE-2023-4966 | doublepulsar.com |
| Fortinet | FortiOS | CVE-2018-13379 | cisa.gov |
| Fortra | GoAnywhere Managed File Transfer | CVE-2023-0669 | cisa.gov |
| Windows | NetLogon | CVE-2020-1472 | cisa.gov |
| PaperCut | PaperCut Application Server | CVE-2023-27350, CVE-2023-27351 | twitter.com/MsftSecIntel |
TTPs Matrix (11)
| Initial Access | Execution | Persistence | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Exfiltration | Command and Control | Impact |
|---|---|---|---|---|---|---|---|---|---|---|
| Valid Accounts | Windows Management Instrumentation | Boot or Logon Autostart Execution: Registry Run Keys | Obfuscated Files or Information | OS Credential Dumping: LSASS Memory | Network Service Discovery | Remote Services: Remote Desktop Protocol | Archive Collected Data: Archive via Utility | Exfiltration Over Alternative Protocol | Proxy: Multi-hop Proxy | Data Encrypted for Impact |
| Exploit Public-Facing Application | Scheduled Task/Job: Scheduled Task | Indicator Removal: Clear Windows Event Logs | Brute Force | Domain Trust Discovery | Remote Services: SMB/Windows Admin Shares | Exfiltration Over Web Service: Exfiltration to Cloud Storage | Remote Access Software | Service Stop | ||
| Phishing | Command and Scripting Interpreter: PowerShell | Disable or Modify Tools | Exploitation of Remote Services | Inhibit System Recovery |
Victims (5)
