Everything you need to know about the LockBit . ransomware family

This type of malware is a major threat to individuals and organizations, with several strains now becoming the top choice for malicious actors, including LockBit.

So what is LockBit, where does it come from and how can you protect yourself from this ransomware?

What is LockBit Ransomware?

Although LockBit started off as a single line of ransomware, it has since evolved several times, with the latest version being called "LockBit 3.0". LockBit includes a group of ransomware programs that operate using the Ransomware-as-a-Service (RaaS) model.

Ransomware-as-a-Service is a business model that involves users paying for access to a certain type of ransomware so they can use it for their own attacks. Through this, that user becomes an affiliate and their payment can include a flat fee or a subscription-based service. In short, the creators of LockBit have found a way to make more profit from its use using this RaaS model and maybe even get a ransom paid by the victim.

Several other ransomware programs can be accessed through the RaaS model, including DarkSide and REvil. Besides, LockBit is one of the most popular ransomware in use today.

Given that LockBit is a family of ransomware, its use involves encrypting the target's files. Cybercriminals will get into the victim's device in one way or another, possibly through phishing emails or malicious attachments, and will then use LockBit to encrypt all the files on the device to cannot be accessed by the user.

Once the victim's files have been encrypted, the attacker will then demand a ransom in exchange for the decryption key. If the victim fails to comply and pay the ransom, chances are that the attacker will then sell the data on the dark web for a profit. Depending on what the data is, this could cause irreparable damage to the privacy of the individual or organization, which could increase the pressure to pay the ransom.

But where did this extremely dangerous ransomware come from?

Origin of the LockBit . ransomware

It is not known exactly when LockBit was developed, but it has been recognized since 2019, when it was first found. This discovery comes after the first wave of LockBit attacks, when the ransomware was originally named "ABCD" in reference to the extension names of the encrypted files exploited in the attacks. But when attackers started using the ".lockbit" file extension instead, the name of the ransomware changed to what it is today.

LockBit's popularity increased after the development of the second version, LockBit 2.0. By the end of 2021, LockBit 2.0 was being used more and more for attacks, and as other ransomware gangs closed, LockBit was able to capitalize on the gap in the market.

In fact, the increasing use of LockBit 2.0 has cemented its position as "the most widely deployed and impactful ransomware variant we've observed of all ransomware breaches." in the first quarter of 2022," according to a report by Palo Alto. On top of that, Palo Alto has stated in the same report that LockBit executives claim to have the fastest encryption of any currently active ransomware.

LockBit Ransomware has been detected in many countries around the world, including China, USA, France, Ukraine, UK and India. Several large organizations have also been targeted using LockBit, including Accenture, an Irish-American professional services firm.

Accenture suffered a data breach used by LockBit in 2021, with attackers demanding a whopping $50 million ransom, with over 6TB of encrypted data. Accenture did not agree to pay this ransom, although the company insists that no customers were affected by the attack.

LockBit 3.0 and its risks

As the popularity of LockBit grows, each new variant is a real concern. The latest version of LockBit, called LockBit 3.0, has become a problem, especially in the Windows operating system.

In the summer of 2022, LockBit 3.0 was used to load harmful Cobalt Strike payloads on targeted devices through the Windows Defender exploit. During this wave of attacks, an executable command-line file called MpCmdRun.exe was abused so that Cobalt Strike beacons could bypass security detection.

LockBit 3.0 was also used to exploit the VMWare command line called VMwareXferlogs.exe to again deploy the Cobalt Strike payload. It is unknown if these attacks will continue or evolve into something completely different.

It is clear that the LockBit ransomware is highly risky, as is the case with many ransomware programs. So how can you keep yourself safe?

How to protect yourself from LockBit . ransomware

Since the LockBit ransomware must first be present on your device to encrypt files, you need to completely prevent the infection in the first place. While it's difficult to guarantee protection from ransomware, there's a lot you can do.

First, never download any files or software programs from websites that are not entirely legal. Downloading any unverified file type to your device can give ransomware attackers easy access to your files. Make sure you are only using trusted and well-reviewed websites to download or official app stores to install software.

Another factor to keep in mind is that the LockBit ransomware usually spreads via Remote Desktop Protocol (RDP). If you do not use this technology, you do not need to worry too much. However, if you do, it's important that you secure your RDP network using password protection, a VPN, and deactivate the protocol when it's not being used directly. Ransomware miners often scan the Internet for vulnerable RDP connections, so adding extra layers of protection makes your RDP network less vulnerable to attacks.

Ransomware can also spread through phishing, an extremely common infection and data theft method used by malicious actors. Phishing is most commonly deployed via email, where an attacker will attach a malicious link to the email body that they will convince the victim to click on. This link will lead to a malicious website that can facilitate malware infection.

Avoiding phishing can be done in a number of ways, including using anti-spam features, link checking sites, and anti-virus software. You should also verify the sender address of any new email and scan for typos in emails (because phishing emails are often full of spelling and grammatical errors).

LockBit continues to become a global threat

LockBit continues to grow and target more and more victims: This Ransomware won't show up anytime soon. To keep yourself safe from LockBit and ransomware in general, consider some of the tips above. While you may think you'll never become a target, you should take the necessary precautions anyway.

Micah Soto

Update 17 February 2023