{"id":12062,"date":"2023-12-01T02:41:10","date_gmt":"2023-12-01T09:41:10","guid":{"rendered":"https:\/\/webdev.securin.xyz\/?p=12062"},"modified":"2024-03-04T11:16:53","modified_gmt":"2024-03-04T18:16:53","slug":"all-about-lockbit-ransomware","status":"publish","type":"post","link":"https:\/\/webdev.securin.xyz\/articles\/all-about-lockbit-ransomware\/","title":{"rendered":"All About LockBit Ransomware"},"content":{"rendered":"\t\t
Originally Published on Mar 23, 2022.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
LockBit Ransomware is one of the few ransomware groups employing self-spreading malware technology and double encryption. After its recent attacks on the <\/b>Aerospace giant, Boeing<\/b><\/a>, the <\/b>Italian Revenue Agency<\/b><\/a> and digital security giant, <\/b>Entrust<\/b><\/a>, LockBit has only gained momentum, as they hunt for their next victim. Read on to learn how to protect your network from LockBit attacks. <\/b><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t One of the most prolific ransomware groups in recent times, LockBit ransomware began its spree of attacks as recently as September 2019. The group is financially motivated and does not shy away from going after bigger, high-profile enterprises and companies. Their latest attack weapon is the CitrixBleed vulnerability (CVE-2023-4966) using which the group waged attacks on Industrial and Commercial Bank of China (ICBC), DP World, Allen & Overy, and Boeing, among many others.<\/span><\/p> LockBit is known for many of its unique characteristics – sophisticated technology, extortion methods, and high-severity cyber attacks. The group is backed by hundreds of affiliates who take care of the \u2018breakin in\u2019 phase, aka,\u00a0 infiltration into vulnerable networks. Thereon, LockBit operators depend on their ransomware code, which has today become one of the best for stealthily creeping through networks, before adopting multiple effective extortion strategies.\u00a0<\/span><\/p> LockBit\u2019s attack presence is seen globally, including Australia, Canada, New Zealand and the United States.\u00a0 Intermittently, the attack spree pauses for a brief period during which their ransomware technology receives superior upgrades, ready to combat advancements in a company\u2019s defense. Their recent attack strategy and frequency makes LockBit a formidable predator in the cyber realm and a determined adversary.<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t Being one of the most active ransomware groups today, LockBit has a variety of tactics and technologies to attack the biggest agencies in any industry. Here are some tools, techniques, and procedures that make LockBit a dangerous adversary:<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t StealBit:<\/strong> The threat gang introduced StealBit, a malware tool used for encryption in the LockBit 2.0 version. It is believed to be the fastest and most efficient encryption tool.<\/p>\n<\/li>\n<\/ul>\n Spreads Fast:<\/strong> StealBit spreads to other devices in the network automatically, using tools like Windows Powershell and <\/span>Server Message Block (SMB), which makes it difficult to confine immediately.\u00a0<\/span><\/span><\/p>\n<\/li>\n<\/ul>\n Attacks Windows and Linux:<\/strong> Initially, they had targeted only Windows systems, but LockBit 2.0 was improvised to attack Linux systems as well.<\/span><\/p>\n<\/li>\n<\/ul>\n Evasion Tactics:<\/strong> Their<\/span> evasion tactics are well strategized, making it hard to get flagged by the system defenses.<\/span><\/p>\n<\/li>\n<\/ul>\n Bug Bounty:<\/strong> LockBit conducts bug bounty programs to improve their defenses and establish that they are professional hackers. Anyone who finds a flaw in their malware kit is rewarded generously.<\/span><\/p>\n<\/li>\n \t Marketing:<\/strong> They actively market towards affiliates to join them and carry out attacks. These marketing activities have garnered quite the attention and work well for the group in getting highly-skilled threat actors.<\/p>\n<\/li>\n \t Double Extortion:<\/strong> LockBit is known for its <\/span>double extortion technique wherein they steal data and also encrypt the system data making it harder for victims to recover it.\u00a0<\/span><\/p><\/li><\/ul> Triple Extortion:<\/strong> In August 2022, LockBit announced that it would use <\/span>triple extortion on its victims via data leaks, encryption, and DDoS attacks.<\/span><\/p><\/li><\/ul> File Deletion:<\/strong> A notable tactic of the third version of LockBit includes a file deletion technique, where instead of using cmd.exe to execute a batch file to perform the deletion.<\/span><\/p><\/li> Exfiltrator-22:<\/strong> A new attack framework was created by affiliates of the former LockBit 3.0 operation that includes features found commonly in other post-exploitation toolkits, but has added features that enhance ransomware deployment and data theft. The EX-22, as it is referred to, is designed to spread ransomware quickly in corporate networks while evading detection.<\/p><\/li> AV and EDR:<\/strong> The LockBit ransomware group started a campaign<\/a> in early January 2023, that used combinations of techniques effective against AV and EDR solutions.<\/p><\/li> Exfiltrate Data:<\/strong> In a recent campaign, the LockBit gang introduced a new method to allow it to exfiltrate data from high-profile organizations by bypassing the Mark of The Web (MOTW)<\/a> protection mechanism.<\/p><\/li><\/ul><\/div><\/div><\/div><\/div><\/div>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t LockBit started out as an ABCD crypto virus in 2019. LockBit\u2019s primary targets were private enterprises and government organizations in the United States, China, India, Indonesia, Ukraine, and Europe with crypto as the form of demanded ransom. In 2019 and 2020, Windows systems in healthcare and financial institutions bore the brunt of LockBit attacks. The Ransomware group took a brief hiatus to work on their malware kit and to improve their operations. Thus far, two other LockBit versions have been released with attack methodologies superior to the preceding ones.\u00a0<\/span><\/p> LockBit version 2.0<\/strong><\/p> LockBit version 2.0 was released in June 2021 and was used for attacks in Chile, Taiwan, and the UK. In this version, LockBit introduced the double extortion technique and automatic encryption of devices across Windows domains. In October 2021, LockBit began infiltrating Linux servers as well, targeting ESXi servers.\u00a0<\/span><\/p> LockBit version 3.0 (LockBit Black)<\/strong><\/p> In June 2022, LockBit released yet another upgraded version of the ransomware with a <\/span>bug bounty program<\/span><\/a>, Zcash payments, and new extortion tactics. The new version derives from other ransomware such as BlackMatter and DarkSide and has anti-analysis techniques to evade detection, passwordless execution, and in-built command-line argument feature. <\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t <\/p> A desktop wallpaper applied by LockBit 3.0 on a victim\u2019s system<\/em><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\tIn This Blog:<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
How Dangerous is LockBit Ransomware?<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n \t
\n \t
\n \t
\n \t
\n \t
Ransowmare Variants<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t