What is LockBit Ransomware?

LockBit Ransomware

malware OpenTrojan Threat Intelligence Updated 2026-08-26

Windows enterprise networks; exfiltration before encryption (double extortion)

Source Attribution

Origin: MITRE
Source: MITRE ATT&CK · CISA KEV
Reviewer: Phase 44E review
Verified: 2026-08-26T15:16:26.825Z
Confidence: high

Source: MITRE ATT&CK · CISA KEV · Verified: 2026-08-26T15:16:26.825Z · Confidence: high

Security Timeline

2019-09 discovered LockBit first observed operating as RaaS
2021-08 exploited LockBit 2.0 double-extortion campaigns
2023-05 updated LockBit 3.0 / Black variant observed

Quick Answer

LockBit affiliates breach networks, exfiltrate data, then deploy ransomware to encrypt hosts; the group operates an RaaS affiliate program.

Definition

LockBit is a ransomware-as-a-service family first observed in 2019. It encrypts systems after data exfiltration and has been used against critical infrastructure worldwide.

Overview

LockBit is a ransomware-as-a-service family first observed in 2019. It encrypts systems after data exfiltration and has been used against critical infrastructure worldwide.

Behavior

Data exfiltration before encryption
Rapid encryption of network shares
RaaS affiliate model

First Seen

2019-09

Target

Windows enterprise networks; exfiltration before encryption (double extortion)

Techniques: T1486, T1567, T1027
Campaigns: moveit-cl0p-exploitation
Related CVEs: CVE-2023-34362, CVE-2021-44228

Malware Intelligence

Family: LockBit Ransomware

Aliases: LockBit 2.0, LockBit 3.0, LockBit Black

Techniques: T1486, T1567, T1027

Targets: Windows enterprise networks; exfiltration before encryption (double extortion)

Behavior:

Data exfiltration before encryption
Rapid encryption of network shares
RaaS affiliate model

References

Have a follow-up question?

Ask OpenTrojan's evidence-backed assistant about this topic — answers cite their sources.

Ask AI about this Start an investigation

Start Investigation

Move from reading to investigating LockBit Ransomware. The workspace is a structured analysis surface — not a chat — organised as:

Question — what do you need to know about LockBit Ransomware?

Evidence — assertions mapped to verifiable references.

Timeline — events in chronological order.

Related Entities — CVE, threat actor, campaign, malware links.

Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.

Notes — your own observations and working hypotheses.

AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.