Search/LockBit 2.0
● Malware

LockBit 2.0

LockBit 2.0 is an affiliate-based Ransomware-as-a-Service (RaaS) that has been in use since at least June 2021 as the successor to LockBit Ransomware. LockBit 2.0 has versions capable of infecting Windows and VMware ESXi virtual machines, and has been observed targeting multiple industry verticals globally.

View graph Watch Export
Indicators tracked
0
Intelligence Reports20
20 intelligence reports available

Curated threat research and citations from CrowdStrike, Mandiant, Microsoft, and other sources — unlock with Premium.

Upgrade to Premium
Connections
28 relationships
T1053.005: Scheduled Task
source
T1047: Windows Management Instrumentation
source
T1548.002: Bypass User Account Control
source
T1489: Service Stop
source
T1135: Network Share Discovery
source
T1120: Peripheral Device Discovery
source
T1082: System Information Discovery
source
T1140: Deobfuscate/Decode Files or Information
source
T1021.002: SMB/Windows Admin Shares
source
T1112: Modify Registry
source
T1484.001: Group Policy Modification
source
T1685.005: Clear Windows Event Logs
source
T1083: File and Directory Discovery
source
T1480: Execution Guardrails
source
T1057: Process Discovery
source
T1059.001: PowerShell
source
T1547.001: Registry Run Keys / Startup Folder
source
T1486: Data Encrypted for Impact
source
T1685: Disable or Modify Tools
source
T1614.001: System Language Discovery
source
T1564.003: Hidden Window
source
T1059.003: Windows Command Shell
source
T1070.004: File Deletion
source
T1136: Create Account
source
T1680: Local Storage Discovery
source
T1490: Inhibit System Recovery
source