LockBit
Attribution profile
- Type
- Crime Syndicate
- Location
- Russia
- Known incidents
- 198 incidents
- Sources
- 190 sources
- First seen
- 2020-04-02
- Last seen
- 2026-08-19
- Updated
- 2026-10-16 12:28
- Aliases
- 4 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
LockBit, also known as LockBit 3.0, LockBit 2.0 and the earlier alias ABCD, is a Russian‑speaking ransomware‑as‑a‑service group whose administrators include the individual identified as Dmitry Yuryevich Khoroshev. The group primarily seeks financial gain through double‑extortion ransomware attacks, encrypting victim data while threatening to leak stolen information if a ransom is not paid. Observed targets span banking institutions in the United States, Senegal and Australia, healthcare providers in the United States and France, pharmaceutical companies, government agencies, educational institutions and industrial firms across Europe, North America and Africa. Initial access has been noted via phishing links clicked by employees, compromise of third‑party suppliers and exploitation of exposed training servers. The ransomware payload is delivered as LockBit 3.0 variants and the group maintains a leak site to publish victim data and apply pressure. Law‑enforcement actions such as Operation Cronos have disrupted its infrastructure, yet the group has continued activity, notably releasing a LockBit 5.0 variant in late 2025. Representative incidents include the 2024 attack on Banque de l'Habitat du Sénégal that exposed 500 000 client records and prompted a $1 million ransom demand, the 2024 ransomware incident at Evolve Bank & Trust that led to the exfiltration of personal and ACH data, and the 2024 LockBit claim against a US bank that triggered a leak‑site posting despite the bank reporting no evidence of compromise.
Incidents
Attributed incidents are available to members.
198 incidentsSources
Sources available to members: 190 sources.