LOCKBIT 3.0 TTP
TTP
Who is LOCKBIT3.0
LockBit 3.0, also known as LockBit Black, is a cybercriminal group that provides Ransomware as a Service (RAAS). With ransomware, a type of malicious software, LockBit 3.0 encrypts the victim’s files and steals their data. If the victim fails to pay the specified amount, they are threatened with the leak of their data.
LOCKBIT 3.0 History
LockBit was first observed in September 2019. Since then, it has evolved: LockBit 2.0 emerged in 2021, while the current version, LockBit 3.0, was discovered in June 2022. Government agencies have not officially attributed the group to any nation-state, but it has been noted that this ransomware group operates on a Russian-language basis, indicating its origin as a cybercriminal group.
The LockBit gang considers itself the "Robin Hood" of ransomware groups. The group promotes the purportedly "ethical" use of ransomware and claims that they will not target healthcare, education, charitable, or social service organizations.According to a joint statement by various government agencies, LockBit 3.0 was the most widespread ransomware in the world in 2022. It was estimated to be responsible for 44% of all ransomware incidents globally in early 2023. While the average ransom amount per incident is typically nearly $1 million, LockBit victims pay an average ransom of approximately $85,000, indicating that LockBit targets small and medium-sized organizations.
LOCKBIT 3.0 TTP
TACTİC
CAPASITY
During compilation, LockBit 3.0 is configured with various options that determine its behavior. Additional arguments can be provided during execution to further alter its behavior. For instance, LockBit 3.0 accepts additional arguments for specific operations such as lateral movement and rebooting into Safe Mode. LockBit affiliates must provide a password argument for certain operations; otherwise, they cannot execute the ransomware. This password serves as a cryptographic key that encrypts the LockBit 3.0 application. This encryption renders the code unreadable and unexecutable, thus preventing detection and analysis.LockBit 3.0 will refrain from infecting machines with language settings matching an exclusion list that includes languages such as Moldovan (Romanian), Syrian (Arabic), and Russian (Tatar). Whether the system language is checked at runtime depends on a configuration flag set during compilation. When an excluded language is detected, LockBit 3.0 halts execution without infecting the system
Instant Connection
Partners installing LockBit 3.0 ransomware typically gain initial access to victim networks through the following means:
Execution and Infection Process
LockBit 3.0 accomplishes the following functions among its operations:
When compiled, LockBit 3.0 can also enable propagation options using Group Policy Objects and PsExec. LockBit 3.0 utilizes the Server Message Block (SMB) protocol. It attempts to encrypt data stored on any local or remote device [T1486], but skips files associated with core system functions.
After encrypting files, LockBit 3.0 leaves a ransom note with a new file name:
Infiltration
LockBit has a proprietary data exfiltration tool called Stealbit, which was utilized by affiliates to pilfer victim data. Affiliates employ the open-source command-line cloud storage manager "Rclone" to execute commands on the victim and access the pilfered sensitive data through the following avenues:Leveraging Free Software and Open Source Tools
TECHNIQUES
