LockBit Ransomware Group: Dark Web Data Leaks Case Study
- securedmonk
- Jun 8
- 15 min read
Introduction to LockBit Ransomware
Since its emergence on the threat landscape, the LockBit Ransomware Group has established itself as one of the most prolific and sophisticated cybercriminal operations in history. By operating under a meticulously structured Ransomware-as-a-Service (RaaS) model, the syndicate has systematically targeted thousands of critical infrastructure entities, corporate giants, and government bodies globally. The group’s resilience is rooted in its continuous software iteration and aggressive marketing strategies, allowing it to maintain a dominant share of the dark web extortion economy. Analyzing LockBit is crucial for modern enterprise defenders because it represents the pinnacle of professionalized cybercrime, where software-engineering rigor is applied to illicit activities. Furthermore, their dark web leak platforms serve as an instructional model for understanding double-extortion and multi-layered coercion tactics. This case study provides a deep technical decomposition of LockBit's infrastructure, its affiliate recruitment workflows, and the technical advances of the newly released LockBit 5.0 variant. As defenders navigate an increasingly volatile threat environment, examining LockBit's persistence through international law enforcement actions such as Operation Cronos offers vital defensive lessons for shielding heterogeneous enterprise systems.
Evolution of the LockBit Ransomware Operation
The evolutionary timeline of the LockBit Cybercrime Operation is marked by a deliberate trajectory of software optimization and brand development. The syndicate first surfaced in September 2019 under the moniker "ABCD," appending a simple .abcd extension to compromised files. By January 2020, the threat actor rebranded as LockBit and formally established its initial affiliate model. The release of LockBit 2.0 (LockBit Red) in mid-2021 introduced automated Active Directory propagation via Group Policy Objects (GPOs) and the custom "StealBit" exfiltration utility, initiating their double-extortion framework. In June 2022, the group launched LockBit Black (LockBit 3.0), integrating modular code fragments from the defunct BlackMatter and ALPHV/BlackCat strains. LockBit Black famously introduced a public bug bounty program and highly encrypted payloads to evade automated analysis. To absorb former Conti affiliates, the syndicate launched LockBit Green in early 2023, utilizing Conti's leaked source code. While late 2024 saw the deployment of LockBit-NG-Dev (LockBit 4.0), an experimental build written in.NET to achieve cross-platform agility, database leaks from mid-2025 indicated that this build remained functionally degraded. Consequently, the operators developed LockBit 5.0 in September 2025, returning to a highly optimized C/C++ foundation. Codename "ChuongDong," this variant is designed specifically to compromise Windows, Linux, and VMware ESXi systems with advanced defense bypasses. Understanding this evolutionary path shows how LockBit operates not merely as a loose collective of hackers, but as an adaptable software enterprise capable of continuous code adaptation.
Anatomy of LockBit's Dark Web Infrastructure
The core of LockBit's extortion apparatus is its dark web infrastructure, engineered to maximize psychological pressure and enforce compliance through public exposure.
Data Leak Portal
Figure 1: LockBit leak portal displaying victims awaiting publication and already published breaches.
The LockBit Victim Leak Portal is a highly stylized, public-facing Tor hidden service where the syndicate displays compromised organizations. Each victim is presented with a red card showing a live, real-time countdown timer that specifies the exact deadline for ransom negotiations. This timer functions as a psychological coercion mechanism, accelerating the victim's decision-making loop. If the timer expires without a paid ransom, the status changes to "published," and the stolen data is made available to the public. This double-extortion strategy completely neutralizes traditional data restoration defenses, as rebuilding systems from offline backups cannot prevent the public exposure of sensitive intellectual property or customer data. Furthermore, the portal includes specialized payment triggers, allowing any third-party visitor to pay a fee to extend the timer, buy the data outright, or destroy it. This multi-tiered monetization structure ensures the leak portal operates as an open-market auction house.
Historical Victim Archive
Figure 2: Historical victim archive showcasing the scale of LockBit's operations.
To sustain their reputation within the cybercrime underground, the operators maintain a comprehensive, searchable LockBit Victim Archive. This interface allows actors to query thousands of historical victims by name, sector, and revenue size. This archive serves as concrete proof of execution, verifying the scale of LockBit's operations to prospective affiliates. For the syndicate, the long-term storage of stolen data provides ongoing monetization opportunities, as the files remain indexable and can be sold to competitor firms, secondary threat actors, or used for subsequent spear-phishing campaigns. Leaked MySQL database dumps from the backend panel reveal that the archive indexes comprehensive meta-information, including direct links to negotiation chats and Bitcoin wallets, showcasing the industrial scale of the backend infrastructure.
Victim Data Repository
Figure 3: Example of a victim-specific repository containing leaked data archives.
When a victim refuses to pay, LockBit hosts the compromised files in structured directories on its LockBit Leaked Data Repository. This repository provides direct downloads of multi-gigabyte ZIP archives containing corporate directories, finance files, and proprietary databases. For massive enterprise datasets that would overwhelm standard Tor bandwidth, the group generates torrent distribution links. This torrent mechanism distributes the file-sharing load across peer-to-peer networks, ensuring that once released, the stolen data remains permanently available on the internet, completing the monetization and reputational destruction phase of their operational lifecycle.
LockBit's Ransomware-as-a-Service (RaaS) Ecosystem
The massive operational volume of LockBit is driven by its structured Ransomware-as-a-Service model, functioning with the division of labor found in legitimate software enterprises.
Affiliate Recruitment
Figure 4: LockBit's affiliate recruitment portal targeting ransomware operators worldwide.
Under the LockBit Affiliate Program, the core developers maintain the ransomware code, dark web portals, and negotiation platforms, while outsourcing network intrusions to freelance operators. The traditional financial split allows the affiliate to retain 80% of the ransom, while a 20% commission is routed back to the core administrators. This relationship leverages a highly specialized division of labor: Initial Access Brokers (IABs) gain initial entry, which they subsequently sell to LockBit affiliates who deploy the encryptor. This commission structure is supported by automated payment routers, which divide incoming cryptocurrency payments on the blockchain directly, sending the operator's cut to long-lived cold wallets while distributing the remainder to the affiliate's preferred addresses.
Affiliate Onboarding Program
To restrict onboarding and prevent infiltration by law enforcement, the operators historically required a trust deposit of 1 Bitcoin (BTC) to access the administrative control panel. However, following the disruption of Operation Cronos, the release of LockBit 5.0 introduced a "Lite Panel" option. This model significantly lowered the onboarding barrier, inviting lower-tier threat actors to register automatically for an upfront fee of only $500 USD. This strategic shift aims to rapidly rebuild the group's diminished affiliate base by commoditizing access. The onboarding portal features a detailed, step-by-step documentation panel, outlining deployment guidelines, providing direct links to helper utilities, and offering operational rules for executing double-encryption attacks using multiple payloads.
Affiliate Benefits and Criminal Branding
Figure 6: Marketing claims used by LockBit to attract and retain affiliates.
To maintain brand dominance, LockBit promoted exceptional operational stability and a unique payment architecture. Unlike rival groups that collected victim payments centrally, LockBit allowed affiliates to host the primary payment wallets, routing the 20% cut to the developers after the transaction cleared. This eliminated the risk of operator exit-scams, establishing LockBit as a highly trusted business partner within the criminal underground. Furthermore, the group prioritized public relations, offering cash payouts for corporate tattoos and technical essays to project a facade of bulletproof stability and corporate professionalism that countered the volatility of the dark web ecosystem.
LockBit Attack Methodology and Technical Capabilities
LockBit’s technical execution relies on a multi-stage attack chain designed for rapid compromise, network traversal, and evasive file encryption.
To achieve initial access, affiliates leverage unpatched vulnerabilities (e.g., Citrix Bleed CVE-2023-4966) to bypass multi-factor authentication (MFA) and hijack active user sessions. They also utilize compromised credentials purchased from Initial Access Brokers (IABs) or conduct brute-force attacks against Remote Desktop Protocol (RDP) and VPN gateways. Once a system is compromised, privilege escalation is executed through token manipulation and utilizing Windows Component Object Model (COM) interfaces to bypass User Account Control (UAC). Lateral movement is accomplished using administrative tools like PsExec and GPO propagation, deploying the ransomware across domain controllers. During lateral movement, the malware also utilizes Windows Management Instrumentation (WMI) and Cobalt Strike beacons to coordinate secondary compromise paths. When compiling the build, affiliates can toggle options to print infinite copies of the ransom note on network-attached printers, overloading physical devices to maximize operational panic.
Data exfiltration is managed using StealBit, a custom exfiltration utility designed for high-speed file harvesting. StealBit parallelizes file transfers to minimize detection windows, utilizing the Microsoft I/O completion port threading model.
The file encryption process varies across targeted operating systems. The Windows payload, compiled in C/C++, employs AES-256 in CTR mode for file contents and RSA-2048 for key wrapping. The Linux and VMware ESXi payloads target virtualized hypervisor hosts, using Go and OpenSSL to directly encrypt .vmdk disk files and .vmsn snapshot directories at the datastore layer. To encrypt files, LockBit 5.0 generates a random 32-byte master key, hashing it via SHA-512 to produce a ChaCha20 key and a 24-byte nonce. The payload performs partial encryption based on file size, fully encrypting smaller files while encrypting only a portion of larger files (above 80MB) to ensure the fastest possible execution speeds. Furthermore, to hinder dynamic analysis, the malware continuously checks heap memory parameters and queries system debug ports via CheckRemoteDebuggerPresent and IsDebuggerPresent, terminating immediately if a debugger is detected.
LockBit's anti-forensic capabilities are highly advanced. The 5.0 variant executes Process Hollowing, launching defrag.exe in a suspended state to execute the ransomware in memory without dropping physical binaries. It unhooks security API calls in user-mode memory and patches Event Tracing for Windows (ETW) by writing a return instruction (0xC3) over EtwEventWrite. It also leverages Bring Your Own Vulnerable Driver (BYOVD) tactics, loading drivers like RTCore64.sys to terminate EDR processes from kernel space. Finally, the loader renames itself to an Alternative Data Stream (ADS) on disk and sets the DeleteFile flag to TRUE via NtSetInformationFile, cleanly removing the physical file from standard directory listings while the process executes in RAM.LockBit Attack Methodology and Technical Capabilities
LockBit’s technical execution relies on a multi-stage attack chain designed for rapid compromise, network traversal, and evasive file encryption.
To achieve initial access, affiliates leverage unpatched vulnerabilities (e.g., Citrix Bleed CVE-2023-4966) to bypass multi-factor authentication (MFA) and hijack active user sessions. They also utilize compromised credentials purchased from Initial Access Brokers (IABs) or conduct brute-force attacks against Remote Desktop Protocol (RDP) and VPN gateways. Once a system is compromised, privilege escalation is executed through token manipulation and utilizing Windows Component Object Model (COM) interfaces to bypass User Account Control (UAC). Lateral movement is accomplished using administrative tools like PsExec and GPO propagation, deploying the ransomware across domain controllers. During lateral movement, the malware also utilizes Windows Management Instrumentation (WMI) and Cobalt Strike beacons to coordinate secondary compromise paths. When compiling the build, affiliates can toggle options to print infinite copies of the ransom note on network-attached printers, overloading physical devices to maximize operational panic.
Data exfiltration is managed using StealBit, a custom exfiltration utility designed for high-speed file harvesting. StealBit parallelizes file transfers to minimize detection windows, utilizing the Microsoft I/O completion port threading model.
The file encryption process varies across targeted operating systems. The Windows payload, compiled in C/C++, employs AES-256 in CTR mode for file contents and RSA-2048 for key wrapping. The Linux and VMware ESXi payloads target virtualized hypervisor hosts, using Go and OpenSSL to directly encrypt .vmdk disk files and .vmsn snapshot directories at the datastore layer. To encrypt files, LockBit 5.0 generates a random 32-byte master key, hashing it via SHA-512 to produce a ChaCha20 key and a 24-byte nonce. The payload performs partial encryption based on file size, fully encrypting smaller files while encrypting only a portion of larger files (above 80MB) to ensure the fastest possible execution speeds. Furthermore, to hinder dynamic analysis, the malware continuously checks heap memory parameters and queries system debug ports via CheckRemoteDebuggerPresent and IsDebuggerPresent, terminating immediately if a debugger is detected.
LockBit's anti-forensic capabilities are highly advanced. The 5.0 variant executes Process Hollowing, launching defrag.exe in a suspended state to execute the ransomware in memory without dropping physical binaries. It unhooks security API calls in user-mode memory and patches Event Tracing for Windows (ETW) by writing a return instruction (0xC3) over EtwEventWrite. It also leverages Bring Your Own Vulnerable Driver (BYOVD) tactics, loading drivers like RTCore64.sys to terminate EDR processes from kernel space. Finally, the loader renames itself to an Alternative Data Stream (ADS) on disk and sets the DeleteFile flag to TRUE via NtSetInformationFile, cleanly removing the physical file from standard directory listings while the process executes in RAM.
MITRE ATT&CK Mapping
Tactic | Technique | Technique ID | Description |
Initial Access | Exploitation of Public-Facing Application | T1190 | Exploitation of vulnerabilities like Citrix Bleed (CVE-2023-4966) to bypass MFA and hijack valid user sessions. |
Execution | Command and Scripting Interpreter: PowerShell | T1059.001 | Using PowerShell scripts to apply Group Policy modifications and initiate attack paths. |
Persistence | Boot or Logon Autostart Execution | T1547 | Modifying registry keys under Winlogon helper paths to survive system reboots. |
Privilege Escalation | Abuse Elevation Control Mechanism: Bypass UAC | T1548.002 | Elevating privileges dynamically using COM objects and bypassing Windows User Account Control. |
Defense Evasion | Process Hollowing | T1055.012 | Spawning a suspended defrag.exe process to inject and execute payloads directly in memory. |
Defense Evasion | Impair Defenses: Disable or Modify Tools | T1562.001 | Patching EtwEventWrite with a ret instruction and loading vulnerable drivers to disable EDR agents. |
Lateral Movement | Remote Services: SMB/Windows Admin Shares | T1021.002 | Propagating payloads remotely across domain controllers using PsExec and SMB shares. |
Exfiltration | Exfiltration Over Web Service | T1567.002 | Running StealBit to exfiltrate targeted directories to remote actor-controlled servers via named pipes. |
Impact | Data Encrypted for Impact | T1486 | Executing optimized file encryption using AES-256 and ChaCha20 + Curve25519 algorithms. |
Indicators of Compromise (IOCs)
Indicator Value | Type | Description |
IP Address | Post-exploitation command-and-control connection point. | |
IP Address | High-confidence Russian exfiltration host used for StealBit data routing. | |
IP Address | Russian geolocated distribution C2 utilized by active affiliates. | |
05b50cbc-5b50-bc05-50cb-05b50cbc05b5 | Mutex | Default single-instance guard mutex loaded during LockBit 5.0 execution. |
f9b9d45339db9164a3861bf61758b7f41e6bcfb5bc93404e296e2918e52ccc10 | SHA-256 Hash | Windows ransomware DLL component compiled from leaked LockBit payloads. |
bb574434925e26514b0daf56b45163e4c32b5fc52a1484854b315f40fd8ff8d2 | SHA-256 Hash | High-fidelity file signature indicating compiled LockBit Black executable. |
Target Selection and Extortion Strategy
LockBit's target selection is governed by a combination of geopolitical constraints, sector vulnerability, and financial opportunistic calculations.
Figure 8: Categories of organizations discussed within LockBit's affiliate documentation.
The group primarily targets sectors that cannot tolerate prolonged operational downtime, such as manufacturing, healthcare, education, finance, and critical infrastructure. Manufacturing is targeted due to supply chain sensitivities, while healthcare networks are highly vulnerable to operational leverage. Under their public affiliate documentation, LockBit allows attacks on military facilities, police stations, space organizations, and non-profit organizations, claiming that responsibility for damage lies with the victim's lack of security rather than the RaaS developers.
Geopolitically, the group maintains a strict exclusion policy prohibiting attacks on post-Soviet countries belonging to the Commonwealth of Independent States (CIS), including the Russian Federation, Armenia, Belarus, Kazakhstan, and Kyrgyzstan. This restriction is enforced programmatically: the ransomware utilizes Windows API calls like GetUserDefaultUILanguage to check for Russian language packs (0x419) or GetUserGeoID to verify country identifiers. If a CIS system is detected, the execution halts. This programmatic guardrail prevents local prosecution by Russian law enforcement, who tolerate ransomware operations that strictly target Western interests.
Furthermore, while LockBit's recruitment materials jokingly claim their operations are based out of Amsterdam, Netherlands, the threat intelligence community confirms their infrastructure and core developers reside inside the Russian Federation. This alignment allows them to ignore Western extradition requests and safely conduct double-extortion campaigns, threatening both encryption and public data release. The double-extortion mechanism is highly standardized: if a victim uses offline backups to recover encrypted hosts, the affiliate leverages the threat of public exposure on the leak portal to force negotiations. In some instances, affiliates also execute DDoS attacks as a triple-extortion technique to bring down public-facing web servers, forcing corporate executives to return to the negotiation table.
Negotiation and Communication Infrastructure Of Lockbit Ransomware Group
LockBit maintains a professional negotiation and support infrastructure designed to ensure seamless financial extraction while protecting their operational security.
Figure 9: LockBit communication channels used for negotiations and affiliate support.
Negotiations are primarily conducted on a dedicated Tor-based chat portal, accessible through a personalized link dropped in the victim's ransom note. For peer-to-peer developer coordination and support, the operators utilize Tox messenger, Telegram channels, and PGP-encrypted emails.
To maximize payouts and standardise negotiations across their affiliate network, LockBit implemented strict negotiation policies in October 2023. The guidelines enforce structured, percentage-based ransom demands based on the victim's annual revenue:
Organizations with revenues up to $100 million pay 3% to 10%.
Entities with revenues up to $1 billion pay 0.5% to 5%.
Global enterprises exceeding $1 billion pay 0.1% to 3%.
Additionally, affiliates are forbidden from offering discounts greater than 50% of the initial demand, or accepting settlements below the maximum limit of the victim's cyber insurance policy. This uncompromising approach was illustrated during negotiations with the US IT service provider CDW, where LockBit rejected a $1.1 million counteroffer on an initial $80 million demand, immediately publishing the stolen files upon the expiration of the countdown timer. This centralized negotiation management ensures that inexperienced affiliates do not devalue the LockBit brand by settling for minor sums. By institutionalizing the extortion process, the group maintains its market standing as a highly disciplined threat syndicate.
Major Victims and Real-World Impact
The real-world impact of LockBit's operations spans global logistics networks, industrial supply chains, and aerospace corporations, highlighting the vulnerability of modern enterprise infrastructure.
In August 2021, LockBit compromised global consultancy giant Accenture, stealing proprietary corporate data and system diagnostics. While Accenture quickly recovered and claimed minimal impact, the syndicate published multiple directories to showcase their access. In January 2023, the group targeted the UK’s Royal Mail, deploying encryptors that halted all international distribution systems and created weeks of critical logistic backlogs. Similarly, high-profile intrusions at Boeing and manufacturing giant Continental demonstrated the scale of LockBit’s targeting, where the exfiltration of sensitive proprietary source files and intellectual property resulted in immediate corporate risk.
Organization | Sector | Impact |
Accenture | Technology | Data exfiltration and publication of proprietary consulting files. |
Royal Mail | Logistics | Complete disruption of international postal and dispatch systems. |
Boeing | Aerospace | Exfiltration and leak of proprietary corporate data and aerospace documents. |
Continental | Manufacturing | Systematic network compromise, data theft, and host encryption. |
These security breaches show that even organizations with multi-million dollar defense budgets are highly vulnerable to initial access exploitation and rapid lateral movement tools. The double-extortion framework continues to represent a highly effective extraction mechanism, as organizations remain vulnerable to the legal and reputational costs of public leaks even after restoring virtual hosts from backups.
Operation Cronos: The LockBit Takedown
In February 2024, an international law enforcement coalition led by the UK’s National Crime Agency (NCA), the US Federal Bureau of Investigation (FBI), and Europol launched Operation Cronos. This joint effort aimed to dismantle the group's front-end leak infrastructure, seizure of crypto accounts, and backend administration consoles.
Operation Cronos successfully seized 34 active servers across Europe and the US, froze over 200 cryptocurrency wallets, and recovered approximately 1,000 decryption keys to assist victims. Law enforcement also placed a seizure notice on LockBit’s Tor sites, replacing their traditional leak site with details of the investigation. Furthermore, the coalition unmasked the core developer and leader of the syndicate, Dmitry Yuryevich Khoroshev (known as "LockBitSupp"), and placed a $10 million USD bounty on his capture.
While (LockBit Ransomware Group)LockBitSupp quickly re-established backup servers and defiantly announced the group’s return, empirical analysis of leaked MySQL database dumps in mid-2025 revealed that Operation Cronos severely degraded their business operations. Under the LockBit 3.0 codebase, affiliates achieved a 54% compromise-to-payment rate; however, following the law enforcement intervention, this success rate plummeted to only 11.5% under the LockBit 4.0 construct. This 4.7-fold decline in operational profitability shattered the trust-based model of the RaaS ecosystem, causing skilled affiliates to flee to competitor groups like RansomHub and Qilin. Additionally, the seizure exposed critical internal communication logs, showing that LockBit administrators failed to delete stolen victim data even after receiving ransom payments, completely destroying their reputation for criminal professionalism and honor among thieves. The takedown proved that even if ransomware code remains intact, targeted infrastructure seizures can dismantle the criminal supply chains that sustain high-volume extortion.
LockBit 5.0 and Current Threat Landscape
Despite the setbacks of Operation Cronos, the threat group adapted by releasing LockBit 5.0 (ChuongDong) in September 2025, signaling a resurgence in active operations. The latest iteration prioritizes hypervisor targeting, deploying specialized payloads designed to bypass Windows, Linux, and VMware ESXi environments. To quickly rebuild their affiliate network, the operators restructured their business model, lowering the sign-up deposit fee to a $500 entrance fee for a "Lite Panel" to attract lower-tier threat actors. This adaptation showcases the resilience of the RaaS model, where the underlying code and financial structures remain active even after major infrastructure takedowns.
In December 2025, the group re-established new active Tor domains on underground forums like XSS and RAMP, claiming dozens of new victims across Europe, the Americas, and Asia. The current threat landscape demonstrates that ransomware operations cannot be resolved through law enforcement action alone. Organizations must prioritize attack surface reduction, timely virtual container patching, and zero-trust segmentations to defend against the technical improvements of LockBit 5.0.
Security Recommendations and Defensive Measures
Harden Authentication Infrastructure: Mandate multi-factor authentication (MFA) across all internet-facing entry points, with a strict emphasis on mitigating session-hijacking techniques. Conduct aggressive patch management to remediate vulnerabilities (such as CVE-2023-4966) that allow threat actors to bypass password prompts and steal active web tokens.
Enforce Micro-Segmentation and Access Controls: Restrict Server Message Block (SMB) protocols and isolate internal domain controllers from guest subnetworks. Configure Registry controls to require explicit User Access Control (UAC) authorization for any remote PsExec deployments, directly reducing lateral movement opportunities.
Deploy Memory-Integrity Monitoring: Leverage endpoint defense systems designed to actively parse runtime code memory. Monitor for anomalies associated with ETW patching, user-mode API hook removal, and process hollowing of trusted executables like defrag.exe.
Implement Driver Signature Enforcement: Set strict system policies to block unauthorized kernel driver loading, actively flagging or preventing execution of signed but vulnerable driver files (such as MSI Afterburner's RTCore64.sys) utilized to terminate local security processes.
Secure and Monitor Hypervisor Datastores: Isolate VMware ESXi shell services and track remote command executions via vim-cmd or esxcli. Ensure that hypervisor logs are forwarded directly to centralized, read-only SIEM appliances on a segregated network segment.
Maintain Air-Gapped Backups: Implement a strict 3-2-1 backup strategy. Maintain offline, fully encrypted, and physically segmented data copies to ensure rapid disaster recovery that completely bypasses the leverage of primary system encryption.
Key Takeaways
Continuous Code Adaptation: LockBit's survival and subsequent transition to version 5.0 prove that threat syndicates function as modular software enterprises capable of continuous design adjustments.
Hypervisor-Centric Targeting: Modern ransomware operations prioritize the datastore layer, developing specialized encryptors to execute broad virtual machine compromise directly at the ESXi and Linux container layers.
Ecosystem Resilience: Lowering affiliate barriers to a $500 Lite Panel demonstrates how RaaS syndicates commoditize access to rapidly rebuild operational volume following high-profile law enforcement takedowns.
The Trust Gap: Law enforcement actions like Operation Cronos successfully degrade ransom profitability by exposing backend vulnerabilities and unmasking leaders, driving a structural realignment in the cybercrime underground.
Comments