LockBit 3.0 (LockBit Black) Ransomware: Attack Chain, TTPs, and MSP Incident Response Guide

In September 2022, an allegedly disgruntled developer publicly leaked the LockBit 3.0 builder. Within days, threat actors unaffiliated with the original operation compiled custom binaries and launched attacks under the LockBit name. Operation Cronos dismantled the core group, yet LockBit 3.0 incidents still persist today because its leaked builder runs independently of the original operators.

If your organization is under active attack, contact ProvenData's emergency ransomware recovery team immediately.

Leak-Site Data: Snapshot as of August 21, 2026*

* Figures reflect attackers publicly claimed victims on the LockBit 3.0 leak site, not total infections.

Understanding LockBit 3.0 today means understanding two overlapping threats: the well-documented Ransomware-as-a-Service (RaaS) operation and the persistent copycat ecosystem that will outlive that operation indefinitely.

This article covers both, from the initial access mechanics and encryption architecture to whether recovery without payment is realistic.

What is LockBit 3.0?

LockBit 3.0, released in June 2022 and sometimes called LockBit Black, is the third major iteration of the LockBit ransomware family.

It improved substantially on its predecessor in two areas: technical resistance to analysis and operational pressure mechanics.

On the technical side, the payload introduced a cryptographic passphrase requirement, the -pass argument. Automated sandbox tools and static analysis frameworks retrieve nothing useful without the operator-supplied key, which is distributed only to affiliates.

On the operational side, LockBit 3.0 launched the first known ransomware bug bounty program, inviting external researchers to report vulnerabilities in its infrastructure in exchange for payment, a deliberate effort to close defensive gaps before law enforcement could exploit them.

The group's public posture was structured to maximize ransom payment rates. Affiliates competed for featured placement on the leak site. The negotiation portal offered scripted openers, standard discount patterns, and professional-style support chat.

This is brand management designed to ensure future victims believed paying produced a working decryptor. That dynamic matters directly when evaluating negotiation options: the genuine operation had a strong financial incentive to deliver, while copycat actors running the leaked builder had none.

From LockBit Black to Green

A separate variant, LockBit Green, emerged by incorporating source code from the defunct Conti ransomware operation. Both variants share the core LockBit 3.0 encryption architecture and come from the same builder lineage, but LockBit Green uses different ransom note filenames and shows some behavioral differences in evasion. For incident response purposes, the underlying recovery approach is the same, though binary analysis is needed to confirm which variant is present.

The RaaS operation

LockBit 3.0 core team developed and maintained the encryptor, leak site, negotiation infrastructure, and StealBit exfiltration tool. Affiliates provided initial access, either through direct exploitation or by purchasing it from Initial Access Brokers, and handled the hands-on intrusion. Affiliates received up to 80% of ransom proceeds.

This division of labor has a forensically important consequence. The tooling ceiling is consistent across affiliates; keyboard skill varies enormously. A meticulous intrusion with weeks of pre-encryption dwell time and a sloppy spray-and-pray deployment can share the same encryptor binary, negotiation portal, and ransom note format. Scoping assumptions must account for both extremes in every engagement.

For a broader explanation of how RaaS operations are structured, see What Is Ransomware as a Service.

LockBit 3.0 attack lifecycle

LockBit 3.0 follows a five-phase attack chain. Understanding the sequence matters for detection timing. By the lateral movement and reconnaissance phase, the attacker typically holds Domain Admin and has already reached backup infrastructure. From that point, the window to contain the intrusion before encryption starts narrows sharply.

Initial access

LockBit affiliates used several documented entry paths. Among them, exposed RDP and VPN endpoints with compromised credentials were the most common vectors.

The attacker's return on initial access is multiplicative rather than linear, which is why MSP environments are high-value targets regardless of the MSP's size. Compromising a single RMM tool deployment can propagate the payload across an entire managed client base within hours.

Execution and anti-analysis

Once deployed, the binary checks the system language via GetSystemDefaultUILanguage. If the system locale matches a CIS or Eastern European country, including Russian, Romanian, and Tatar, execution halts.

The payload then terminates processes and services that could interfere with encryption: database engines, backup agents, security tools, and applications holding open file handles.

"Security tools being disabled, shadow copies being deleted, backup consoles being accessed, remote execution spreading across systems, and payloads staged on admin shares. When those events cluster within minutes, we treat it as ransomware deployment in progress, not isolated suspicious activity," explains Magdy Abdelaziz, Head of Proven Data’s DFIR team.

Lateral movement and reconnaissance

Discovery tooling observed across LockBit 3.0 engagements includes AdFind, BloodHound, Advanced IP Scanner, Seatbelt, and SoftPerfect NetScan.

Lateral movement runs primarily over SMB via PsExec and can be pushed domain-wide through Group Policy Object (GPO) modification, compressing the encryption window from hours to minutes once triggered.

Cobalt Strike beacons maintain persistent command-and-control through the dwell period, which typically precedes encryption by days to weeks.

Exfiltration

LockBit affiliates use StealBit for high-speed staging, supplemented by Rclone, MEGAsync, and WinSCP for cloud transfer. SystemBC proxy tunnels mask exfiltration traffic inside encrypted channels that blend with legitimate outbound activity.

Exfiltration occurs prior to encryption to ensure attackers secure copy-based leverage before alerting the target.

Impact

Shadow copies are deleted via vssadmin delete shadows /all /quiet or through WMI calls, specifically to avoid process-level monitoring triggers. 

Desktop wallpaper is replaced with LockBit ransom note branding, and notes are written across all accessible directories and, in some engagements, pushed to network printers.

The encrypted file extension is a random 9-character string unique to each deployment, making rapid detection based on extension matching unreliable.

Quadruple extortion

LockBit 3.0 operated a quadruple extortion model: file encryption, data exfiltration and leak-site publication, DDoS against the victim's public infrastructure, and direct harassment of the victim's customers, vendors, or regulators.

The incident's classification also changes permanently the moment data appears on a leak site. "From that minute forward, the data should be treated as permanently public, and the response becomes a breach-notification and harm-reduction exercise rather than a technical one," says Abdelaziz.

Weaponization of published data is the norm. Leaked invoices, contracts, and executive correspondence become pretexts for business email compromise against the victim's customers and suppliers, often within days of publication. Credential dumps from leaked data feed credential-stuffing campaigns within the same window. Organizations should prepare follow-on fraud warnings to business partners concurrent with breach notifications, not after.

Disclosure obligations are also activated by publication. GDPR's 72-hour clock, HIPAA's breach notification requirements, the SEC's four-business-day rule for public companies, and applicable state breach laws all carry their own triggers. Legal counsel should assess which notification deadlines are running and how much time remains.

DO NOT PAY THE RANSOM. Decisions about ransom payment carry legal, operational, and financial consequences that qualified legal counsel and an incident response team should assess before taking any action.

LockBit Black technical architecture

LockBit 3.0's design prioritizes two objectives: defeating analysis before deployment and eliminating defenses before encryption runs.

Each architectural feature below reflects a specific engineering decision made in response to prior detection methods. That iterative hardening helped the variant remain effective across a wide range of environments throughout its operational period.

Payload protection

The most operationally significant architectural feature of LockBit 3.0 is the passphrase execution requirement. The binary is encrypted with a cryptographic key supplied at runtime via the -pass argument. This design was a deliberate response to prior LockBit iterations being easily analyzed and detected.

Encryption implementation

File content is encrypted with AES-256 symmetric encryption. The key is then wrapped with Elliptic Curve Cryptography, replacing the RSA key protection used in LockBit 2.0. The ECC-wrapped key cannot be recovered without the operator's private key, which means no independent brute-force path to decryption exists.

Security tool termination

LockBit affiliates use a consistent toolkit to suppress EDR and AV before running the encryptor. GMER, Process Hacker, Defender Control, and Backstab (which exploits the legitimate Process Explorer driver to terminate EDR processes from kernel mode) are the most commonly documented tools.

Where tamper protection is enforced, the cost of this step rises significantly. Without it, the sequence from driver load to EDR termination to encryption start takes seconds.

Persistence and post-execution cleanup

Persistence is established through registry modification (Winlogon\AutoAdminLogon), scheduled tasks, and rogue services created during the intrusion.

After encryption completes, the binary deletes itself to remove the most obvious forensic artifact. Windows event logs are cleared. These cleanup steps are not universal across all affiliate deployments, so event log gaps are a forensic signal worth investigating during the scoping phase.

MITRE ATT&CK mapping

The table below maps observed LockBit 3.0 behaviors to MITRE ATT&CK techniques across the full kill chain.

Confidence ratings reflect how consistently each technique has appeared across documented affiliate engagements.

Because the leaked builder produces varying binaries, not every technique is present in every incident.

Sources: MITRE ATT&CK S1202; CISA Advisory AA23-075A.

Indicators of compromise

The hashes, IP addresses, ransom note filenames, and YARA rules below provide a starting point for detection and threat hunting across LockBit 3.0 incidents.

IOC disclaimer: No IOC list is exhaustive for LockBit 3.0. The leaked builder has produced thousands of binaries across affiliated and copycat operations since September 2022. Treat these as detection aids, not clearance signals.

MD5 Hashes (selected)

IP addresses (observed C2 and exfiltration)

Ransom note filenames

README.txt

Restore-My-Files.txt

ReadMeForDecrypt.txt

Lockbit3.txt

Is LockBit 3.0 still active?

LockBit 3.0 is not active as a cohesive operation as of August 2026. Operation Cronos, the coordinated law enforcement action led by the UK's National Crime Agency and Europol in February 2024, seized core infrastructure, obtained decryption keys for some victims, and led to the U.S. Department of Justice's indictment of the group's administrator, Dmitry Khoroshev.

The original leak site last posted a victim in December 2025. A successor operation branded LockBit 5.0 announced its new version in September 2025 and launched a Christmas-themed DLS in December 2025, with a builder that has not been publicly leaked.

For any organization hit by what appears to be LockBit today, determining whether the incident involves a genuine affiliate or a copycat has direct operational consequences for recovery planning.

The most reliable authenticity signal is the negotiation URL. Genuine affiliates receive a Tor address tied to the authentic LockBit panel, and their victims appear on the genuine leak site. Copycats cannot replicate this.

Binary analysis separates LockBit 3.0 builder samples, in circulation since 2022, from LockBit 5.0 binaries, which were never publicly leaked and, when found, provide near-conclusive evidence of the real post-Cronos operation.

Can files encrypted by LockBit 3.0 be recovered?

Recovery without paying ransom is possible in some cases, and you should exhaust those options before deciding whether to pay.

For attacks prior to February 2024, check No More Ransom (nomoreransom.org) for decryptors from the initial Cronos seizure, and the FBI's Internet Crime Complaint Center (ic3.gov), which holds over 7,000 keys recovered through the broader Cronos disruption effort.

ProvenData's ransomware recovery team handles LockBit 3.0 incidents end-to-end, from forensic scoping through data restoration, including cases where no clean backup exists

No public decryptor exists for LockBit 3.0 encryptions performed after the Cronos seizure.

Practical recovery options include clean, tested backups.

Incident response checklist

The single action in the first sixty minutes that determines whether recovery takes days or weeks is deliberate, aggressive network isolation: severing connectivity at the switch and VLAN level rather than powering off systems.

Volatile memory may be needed for forensic key extraction, and reimaging before the full scope is established destroys the evidence required to prove eradication.

Immediate containment

• Disconnect infected systems at the switch port or VLAN level; do not power off where volatile memory capture may be needed.
• Isolate Domain Controllers and backup infrastructure first; treat them as contested until proven clean.
• Terminate suspicious RMM agent instances (AnyDesk, Atera, Splashtop, ScreenConnect).
• Force password resets on all Domain Admin and MSP service accounts.
• Audit GPOs for malicious scheduled tasks, modified logon scripts, or unauthorized policy changes.
• Stand up out-of-band communications using personal devices; assume corporate email is compromised.

Forensic preservation

• Lock down Sysmon logs, Security Event Logs (Event IDs 4624, 7045), VPN authentication logs, and firewall logs.
• Search process execution history for -pass argument usage.
• Audit outbound traffic for connections to Rclone, MEGAsync, WinSCP, or SystemBC infrastructure.
• Capture volatile memory on hosts suspected of running active beacons before any reimaging.

Recovery sequencing

• Verify backup integrity on an isolated segment before connecting to any production infrastructure.
• Test restoration throughput on representative systems before committing to a timeline.
• Run OFAC sanctions screening against any cryptocurrency wallet address before any payment.
• Test any provided decryptor on a fully isolated host before domain-wide deployment.
• Audit restored Active Directory backups for poisoned GPOs and modified logon scripts before bringing them online.

For end-to-end containment and recovery guidance, see ProvenData's incident response services and the LockBit 3.0 ransomware removal case study from a prior engagement.

Security hardening checklist

Each item maps to a LockBit 3.0 TTP described in this article.

• Patch edge devices as a standing priority. CVE-2018-13379, CVE-2023-27350, and CVE-2023-0669 were actively exploited. Equivalent current-generation edge CVEs remain active affiliate entry points.
• Enforce MFA on all VPN and RDP endpoints. Enforce MFA at the system level, not as an option; credential abuse is LockBit's most common initial access vector.
• Restrict and monitor RMM tool permissions. Alert on new agent installations and limit which accounts can deploy agents across the environment.
• Enable tamper protection on EDR across all endpoints. Enforced tamper protection significantly increases the cost and difficulty for attackers attempting kernel- or driver-level EDR termination.
• Segment and isolate backup infrastructure. Backup consoles accessible from the domain are a pre-encryption target. Apply the 3-2-1-1-0 backup rule to increase your chances for data recovery.

• Test backup restoration under realistic conditions. An untested backup is an operational liability, not a recovery asset.
• Restrict GPO creation and modification permissions. Alert on GPO changes outside approved change-control windows.
• Monitor for pre-encryption behavioral clusters. Shadow copy deletion, security tool termination, and backup console access occurring within the same short window is ransomware deployment in progress, not separate tickets.
• Implement network segmentation. Flat networks amplify SMB and GPO-based propagation; segmentation forces pivoting, and each pivot creates detectable forensic evidence.