Search/LockBit 3.0
● Malware

LockBit 3.0

LockBit 3.0 is an evolution of the LockBit Ransomware-as-a-Service (RaaS) offering with similarities to BlackMatter and BlackCat ransomware. LockBit 3.0 has been in use since at least June 2022 and features enhanced defense evasion and exfiltration tactics, robust encryption methods for Windows and VMware ESXi systems, and a more refined RaaS structure over its predecessors such as LockBit 2.0.

View graph Watch Export
Indicators tracked
0
Intelligence Reports40
40 intelligence reports available

Curated threat research and citations from CrowdStrike, Mandiant, Microsoft, and other sources — unlock with Premium.

Upgrade to Premium
Connections
49 relationships
T1132.001: Standard Encoding
source
T1027.013: Encrypted/Encoded File
source
T1548.002: Bypass User Account Control
source
T1489: Service Stop
source
T1573.001: Symmetric Cryptography
source
T1543.003: Windows Service
source
T1135: Network Share Discovery
source
T1120: Peripheral Device Discovery
source
T1082: System Information Discovery
source
T1106: Native API
source
T1140: Deobfuscate/Decode Files or Information
source
T1480.002: Mutual Exclusion
source
T1218.003: CMSTP
source
T1021.002: SMB/Windows Admin Shares
source
T1112: Modify Registry
source
T1484.001: Group Policy Modification
source
T1547.004: Winlogon Helper DLL
source
T1685.005: Clear Windows Event Logs
source
T1083: File and Directory Discovery
source
T1480: Execution Guardrails
source
T1057: Process Discovery
source
T1059.001: PowerShell
source
T1486: Data Encrypted for Impact
source
T1685: Disable or Modify Tools
source
T1614.001: System Language Discovery
source
T1688: Safe Mode Boot
source
T1070.004: File Deletion
source
T1027.002: Software Packing
source
T1071.001: Web Protocols
source
T1622: Debugger Evasion
source
T1569.002: Service Execution
source
T1680: Local Storage Discovery
source
T1490: Inhibit System Recovery
source
T1078.003: Local Accounts
source