Clankerusecase
Threat-actor profile
 ← Back to main site
Home/ Threat Actors/ LockBit

🇷🇺LockBit

🇷🇺 LockBit is a tracked threat actor in the Clankerusecase corpus. Attributed to RU. Primary motivation: Criminal. We map 14 detection use cases to this actor across 35 MITRE ATT&CK techniques, with 4 threat-intel articles citing them. Active in our corpus from 2025-12-11 to 2026-04-20.

crit 3high 1
View full actor card → All threat actors
14Use cases
4Articles
35Techniques
0IOCs

Known aliases

LockBitLockBit 2.0LockBit 3.0LockBit BlackLockBit GreenLockBit 5.0

Top techniques

T1190 · Exploit Public-Facing ApplicationT1486 · Data Encrypted for ImpactT1003.001 · LSASS Memory

All other tracked techniques

T1003 · OS Credential DumpingT1014 · RootkitT1021.002 · SMB/Windows Admin SharesT1027 · Obfuscated Files or InformationT1027.002 · Software PackingT1027.005 · Indicator Removal from ToolsT1027.009 · Embedded PayloadsT1037.001 · Logon Script (Windows)T1055 · Process InjectionT1059.001 · PowerShellT1059.003 · Windows Command ShellT1059.005 · Visual BasicT1068 · Exploitation for Privilege EscalationT1070.004 · File DeletionT1140 · Deobfuscate/Decode Files or InformationT1195.002 · Compromise Software Supply ChainT1204.001 · Malicious LinkT1204.002 · Malicious FileT1204.004 · Malicious Copy and PasteT1218 · System Binary Proxy ExecutionT1219 · Remote Access ToolsT1489 · Service StopT1490 · Inhibit System RecoveryT1543.003 · Windows ServiceT1562.001 · T1562.001T1562.004 · T1562.004T1562.006 · T1562.006T1562.009 · T1562.009T1566 · PhishingT1566.001 · Spearphishing AttachmentT1566.002 · Spearphishing LinkT1569.002 · Service Execution

Detection use cases (14)

LockBit (BITWISE SPIDER) pre-encryption inhibit-recovery command chain AI · profile SΣ LockBit affiliate Rclone-to-MEGA / StealBit double-extortion exfiltration AI · profile SΣ Phishing-link click correlated to endpoint execution Internal Fake CAPTCHA / clipboard-injected PowerShell (ClickFix / FakeCaptcha) Internal Ransomware-style mass file rename / extension change Internal LSASS process access / dump (credential theft) Internal Remote service execution — PsExec / SMB lateral movement Internal Trusted vendor binary / installer launching unusual children Internal BYOVD: Genshin Impact mhyprot.sys driver dropped/loaded outside legitimate game install (Embargo evil-mhyprot-cli) Bespoke EDRSilencer-style WFP filter blocking outbound traffic from named EDR binaries Bespoke EDR-Freeze: WerFaultSecure.exe abused to suspend AV/EDR processes via MiniDumpWriteDump race Bespoke Phishing-link click correlated to endpoint execution Internal Email attachment opened from external sender Internal Office app spawning script/LOLBin child process Internal

Threat-intel articles (4)

crit What the ransom note won’t say · 2026-04-20
crit EDR killers explained: Beyond the drivers · 2026-03-19
crit Naming and shaming: How ransomware groups tighten the screws on victims · 2026-02-12
high Black Hat Europe 2025: Reputation matters – even in the ransomware economy · 2025-12-11