LockBit
Attribution profile
- Type
- Crime Syndicate
- Location
- Russia
- Known incidents
- 3 incidents
- Sources
- 118 sources
- First seen
- 2024-06-20
- Last seen
- 2026-08-19
- Updated
- 2026-10-14 04:09
- Aliases
- 3 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
LockBit, also known as LockBit 2.0 and LockBit 3.0, is a ransomware group linked to Russia that operates under a ransomware‑as‑a‑service model with affiliates. It has targeted a wide range of sectors including banking, healthcare, government, manufacturing, technology and education across regions such as the United States, Canada, Europe and Asia. Its primary objective is financial extortion, employing double‑extortion tactics that encrypt victims’ data and threaten to publish stolen information on its leak site unless a ransom is paid. Observed tactics, techniques and procedures include the deployment of LockBit ransomware malware, use of a public leak site with countdown timers, and initial access gained through third‑party suppliers or compromised devices such as a rogue Windows 7 PC. Notable publicly reported operations include the ransomware attack on Indonesia’s national data center in June 2024, the LockBit 3.0 intrusion at TSMC via its supplier Kinmax Technology in June 2023, the Zaun breach in August 2023 involving a rogue Windows 7 machine, the alleged LockBit claim against a US bank in August 2026, the Ontario Medical Supply incident in March 2025, and the South Korean National Tax Service leak in March 2023.
Incidents
Attributed incidents are available to members.
3 incidentsSources
Sources available to members: 118 sources.