What is LockBit Ransomware?

Key takeaways

• LockBit is a ransomware-as-a-service (RaaS) model. The operators build the tooling, and affiliates run the attacks.
• Its signature technique abuses Active Directory Group Policy to deploy the payload across an entire domain at once.
• LockBit was disrupted by international law enforcement in February 2024. A rebuilt LockBit 5 resurfaced in late 2025.
• The scale of damage depends on how far the payload can travel inside the network once it runs.
• Microsegmentation closes the internal pathways LockBit relies on, containing encryption to the segment where it started.

What is LockBit ransomware?

LockBit is a family of ransomware operated as a service since 2019, progressing through versions including LockBit 2.0, LockBit 3.0 (also called LockBit Black), and LockBit 5. Affiliates rent the malware and infrastructure, then run their own intrusions. The RaaS model let LockBit scale faster than groups that ran every cyberattack themselves. As a result, LockBit ranked as the leading threat for several years, claiming more victims than any other ransomware operation.

How does LockBit ransomware spread?

The LockBit malware spreads in two steps. First, it gains administrative control of the Windows Domain. Second, it propagates to each device on the domain. Before either step, affiliates gain entry through an unpatched edge device, an exposed remote service, or compromised credentials.

Once affiliates gain entry, they elevate privileges to eventually obtain full domain admin rights. In this elevated state, LockBit affiliates use Group Policy Objects (GPOs) to deploy the payload to all machines joined to the domain simultaneously. This technique has been identified as MITRE ATT&CK T1484.001. Some versions of the LockBit payload include self-spreading capabilities, allowing a single execution to seed additional targets.

Propagation relies on unrestricted internal network connections. Many enterprise networks allow systems to reach one another freely, with no controls separating them. When the malware infects a single machine in that environment, it can spread immediately to every connected system.

What are the different LockBit ransomware variants?

Each LockBit version built on the one before it. These are the variants that defined the operation.

ABCD ransomware (2019)

The original strain appended an ".abcd" extension to encrypted files, which is what researchers named it after. In less than a year, the ransomware operation rebranded as LockBit and launched its affiliate model, which eventually fueled its rapid rise.

LockBit 2.0

The 2021 release of LockBit 2.0 scaled the operation up: encryption ran faster, and deployment was automated. LockBit also introduced StealBit, a purpose-built exfiltration tool. Combining data theft with file encryption established the double-extortion model that most large-scale ransomware groups later adopted.

LockBit 3.0 or LockBit Black

This 2022 variant added a bug bounty program along with stronger evasion and customization options. Researchers also found large portions of shared code with BlackMatter and BlackCat. Emsisoft's Fabian Wosar told ITPro that “large portions of the code are ripped straight from BlackMatter/Darkside.”

LockBit Green and Cross-Platform Variants

In early 2023, researchers found that LockBit had incorporated roughly 25% of Conti's source code, including using the same ransom note format and encryption method, according to Kaspersky's Securelist. During this time frame, LockBit announced the development of cross-platform versions including a Linux build and a VMware ESXi build. Researchers also found early samples built to run on macOS.

LockBit 5.0

Law enforcement disrupted LockBit through “Operation Cronos” in February 2024, but the operation continued in diminished form. In late September of 2025, LockBit announced a new version called LockBit 5.0. According to Trend Micro, LockBit 5.0 will be available in rebuilt Windows, Linux, and ESXi builds. LockBit 5.0 adds an ESXi encryptor that can reach every virtual machine on a host server in a single action. Both the Windows and ESXi variants use random 16-character file extensions in place of LockBit's previously static signature.

What makes LockBit ransomware dangerous?

LockBit is dangerous because it drives both immediate operational disruption and long recovery times. Encryption of a single endpoint is a localized incident. With LockBit, every reachable endpoint - servers, workstations, mobile devices - can be encrypted, which can mean a total operational outage.

Together, these elements create a situation where threat actors will not only encrypt your files but also steal them and threaten to release them publicly. This creates pressure to pay the ransom regardless of whether you had backups.

The volume of affiliates also broadens the range of initial-access methods, so there is no single entry point to defend. Reported LockBit targets have spanned financial services, manufacturing, logistics, and public sector organizations worldwide.

Is LockBit ransomware still active?

LockBit is active in a rebuilt form. A coordinated 2024 operation seized LockBit infrastructure and exposed its affiliates, damaging the brand. LockBit 5 relaunched a leak site in late 2025 and resumed claiming victims, though it now operates behind higher-volume groups rather than at the top of the field. The tactics outlive any single takedown, because privileged domain-wide deployment carries over to successor and affiliate operations.

What should you do after a LockBit ransomware infection?

Once you confirm that LockBit has infected your network, speed and sequence are vital to mitigate the damage. To guide this time-sensitive process, follow these steps deliberately.

• Isolate first: Disconnect affected systems from the network and restrict the accounts and protocols the attackers used. This stops active encryption from spreading further while you assess the damage.
• Activate your response plan: Bring together your incident-response team immediately. Before making any decision about how to recover, determine which systems, user accounts, and types of data have been affected.
• Preserve evidence: Take the necessary logs, memory images, and disk snapshots before removing the malware from your systems or rebuilding. This evidence supports law enforcement reporting and any insurance claim you file.
• Reset and investigate: Immediately change any credentials that may have been compromised. Additionally, look at Active Directory, VPNs, and remote-access tools for backdoor entry points or other possible re-entry paths established by LockBit.
• Restore carefully: Rebuild from only verified clean backups. Eradicating LockBit from your systems removes the active infection, but it does not decrypt your compromised files.

These steps limit the damage from this attack, but none of them prevents the next one from spreading.

How do you contain a LockBit attack?

You contain LockBit by closing the open internal pathways its spread depends on. Preventing every initial infection is not realistic. Stopping the domain-wide spread is, provided segmentation is already in place before an attack begins.

Microsegmentation divides the environment into isolated zones and permits only the traffic each workload requires. When a host is compromised, the paths LockBit would use to reach the rest of the estate are already closed, including the administrative and file-sharing protocols it relies on to move. Encryption stays confined to the segment where it started. This is what a breach containment platform does: the attacker gets in, and the attack does not reach everything.

Frequently asked questions about LockBit ransomware

What type of malware is LockBit?

LockBit is ransomware distributed through a ransomware-as-a-service (RaaS) model, in which affiliates run the attacks using the core group's tools and infrastructure.

How does LockBit spread across a network?

LockBit gains access to Active Directory, then utilizes Group Policy to deploy the payload to every machine on the domain at once, instead of attacking them one at a time.

Can microsegmentation stop LockBit?

Microsegmentation can't block the initial intrusion. But once LockBit is inside, the internal paths it needs to spread are already closed, so encryption stays confined to a single segment.

Is LockBit still a threat?

Yes. LockBit 5 launched in late 2025, after the 2024 law enforcement takedown, and its domain-wide deployment tactic persists across successor operations.