Lockbit (cyber gang)
# Lockbit (cyber gang)

LockBit is a prominent cybercriminal group known for its professional operations and strong affiliate program. They employ a ransomware as a service (RaaS) model and consistently develop new techniques to stay ahead of their competitors. They use double extortion tactics where they not only encrypt the victim's data but also threaten to leak it if their demands are not met.

## Description

LockBit has gained attention for its creation and use of the malware StealBit, which automates the exfiltration of data. This tool was introduced with the release of LockBit 2.0, which is praised for its fast and efficient encryption capabilities. To expand their reach, LockBit also released Linux-ESXI Locker version 1.0, targeting Linux hosts, particularly ESXi servers.

LockBit's recrutes affiliates and develops partnerships with other criminal groups. They hire network access brokers, cooperate with organizations like Maze, and even recruit insiders from targeted companies. To attract talented hackers, they have sponsored underground technical writing contests.

LockBit has targeted various industries globally. According to Trend Micro, the United States has witnessed the highest number of LockBit attack attempts, followed by India and Brazil. The healthcare industry has been the most affected, followed by the education sector.

LockBit's impact and tactics demonstrate their efficiency and adaptability. They emphasize their malware's speed and capabilities to attract victims. They take external factors like data privacy laws into consideration when targeting potential victims. LockBit's success also relies heavily on their affiliate program, which helps them innovate and compete in the ransomware landscape. Additionally, their operations are expected to continue or even escalate in the future.

## History

LockBit came into the spotlight with their attack on Accenture in 2021, where it is suspected that an insider helped the group gain access to the firm's network. LockBit also reportedly published a small portion of the stolen data from this attack.

In late June 2022, LockBit launched LockBit 3.0, the latest variant of their ransomware, after two months of beta testing. Notably, the group introduced a bug bounty program, the first of its kind in the realm of ransomware operations. They invited security researchers to submit vulnerability reports to improve their operations, offering substantial monetary rewards ranging from $1,000 to $1 million.

