LockBit Ransomware: How It Works, Versions, Tactics, and Defense

Last verified: July 13, 2026

LockBit is both the name of a criminal ransomware-as-a-service operation and a family of ransomware used to steal data, encrypt systems, disrupt operations, and pressure victims. It is not one fixed intrusion team: core developers, administrators, affiliates, access brokers, infrastructure providers, and unrelated actors reusing leaked LockBit builders can play different roles.

Operation Cronos caused a major disruption in February 2024, but it did not make LockBit-derived code or future activity impossible. LockBit 5.0 samples targeting Windows, Linux, and ESXi were subsequently analyzed independently. Affiliate variation and code reuse mean that finding a LockBit-like sample does not, by itself, identify the responsible intrusion team.

This guide explains the ecosystem, versions, disruption, current status, attack lifecycle, defensive priorities, response options, and limits of available decryptors in the broader context of major ransomware groups.

Key takeaways

• LockBit refers to both a ransomware family and a ransomware-as-a-service, or RaaS, operation.
• Affiliates normally conduct intrusions, so entry paths, tools, targets, and post-access behavior can differ substantially.
• Operation Cronos seized infrastructure, recovered intelligence and decryption keys, supported arrests and sanctions, and damaged affiliate trust but did not erase leaked code or every participant.
• LockBit-related activity remained relevant after the disruption, although the scale and central control of the pre-Cronos operation cannot be assumed.
• LockBit 5.0 binaries for Windows, Linux, and ESXi were independently analyzed in 2025 and 2026. Their existence does not prove widespread adoption.
• Strong identity controls, restricted remote access, segmentation, protected telemetry, isolated backups, and rehearsed response remain the main defensive priorities.
• An official LockBit 3.0 decryptor may help eligible victims, but it is not universal and does not replace containment, investigation, or validated restoration.

LockBit quick facts

Important: This is educational defensive guidance, not legal advice or an incident-specific recovery plan. An active ransomware incident should involve qualified incident responders, legal counsel, appropriate authorities, the organization’s insurer, and relevant sanctions specialists.

What is LockBit ransomware?

LockBit ransomware is a family of malicious encryption tools associated with a criminal RaaS ecosystem. Core operators developed and maintained the service, while largely independent affiliates obtained access to victim environments and conducted attacks. Consequently, “LockBit attack” can describe the malware used without reliably identifying one operator, affiliate, or intrusion method.

Ransomware-as-a-Service separates platform development from intrusion activity. LockBit’s administrators supplied malware builders, supporting infrastructure, leak or negotiation services, and an affiliate program. Affiliates selected targets, acquired or purchased access, moved through networks, stole data, and deployed ransomware.

This division matters for both attribution and defense. As the joint CISA LockBit advisory explains, LockBit’s large and initially unvetted affiliate population produced significant variation in tactics, techniques, and procedures.

“LockBit” can therefore refer to several related but distinct things:

• The core criminal operation or brand.
• Developers and administrators maintaining the service.
• Affiliates conducting individual intrusions.
• The ransomware malware family and its versions.
• Data-theft and negotiation infrastructure.
• Initial-access brokers or infrastructure providers supporting attacks.
• Third parties using leaked builders or modified LockBit code without proven coordination with the original administrators.

LockBit attacks commonly combined encryption with data theft and threats to publish stolen information a form of double extortion. A leak-site listing, however, remains a criminal claim unless the victim, authorities, or independent evidence confirms the incident and its scope.

How the LockBit Ransomware-as-a-Service model works

Figure 1. LockBit’s RaaS model separates core platform development from affiliate-led intrusions, making attack behavior and attribution inconsistent.

Source note: DeepStrike synthesis based on CISA, DOJ, Treasury, and Europol reporting.

At a high level, LockBit administrators developed the ransomware platform and recruited affiliates. An affiliate obtained initial access directly or through another criminal supplier then conducted the intrusion. Victim-specific ransomware builds or configurations could be generated through the service. Stolen data, encryption, negotiation infrastructure, and revenue sharing completed the commercial model.

The allocation of responsibilities was not necessarily identical in every case. Affiliates could bring different tooling, access methods, targets, and experience. Infrastructure seizures can consequently damage central coordination and revenue while leaving individual affiliates, credentials, stolen data, or copied malware code available elsewhere.

Is LockBit still active?

The most accurate answer is dated and qualified: LockBit-related malware and activity remained relevant as of July 13, 2026, but available evidence does not establish that the original pre-Cronos organization regained its former scale or central control.

The UK National Crime Agency’s May 2024 assessment said LockBit was operating at limited capacity and that its global threat had been significantly reduced at that point. That was a dated assessment, not proof that all future activity was eliminated.

Later developments cut both ways. A reported May 2025 compromise of LockBit infrastructure suggested further damage to its operational security. Conversely, Trend Micro’s LockBit 5.0 analysis and LevelBlue’s 2026 sample research established that technically developed LockBit-branded samples continued to exist.

Neither observation alone measures successful intrusions, confirmed victims, affiliate participation, or the authority of a central operator.

LockBit timeline: 2019 to the latest verified update

The legal distinction is important. The official sources reviewed for this article describe Khoroshev as charged and sanctioned, not convicted. A March 2025 DOJ release described Panev as extradited to the United States and detained pending trial.

Figure 2. LockBit’s evolution includes malware releases, law-enforcement disruptions, infrastructure exposure, and later independently analyzed samples.

Source note: CISA, DOJ, NCA, Europol, U.S. Treasury, Trend Micro, BleepingComputer, and Reuters; dates and status reverified before publication.

LockBit versions compared

The version number identifies malware lineage, not necessarily the humans responsible for an intrusion. A third party using a leaked LockBit 3.0 builder can create a technically LockBit-compatible sample without being an authorized affiliate of the original service.

How a LockBit attack typically progresses

There is no universal LockBit intrusion chain. The following lifecycle synthesizes behavior described by CISA, MITRE ATT&CK, incident reporting, and primary technical analysis. It should be used as a defensive model not as an assertion that every affiliate performs every stage.

Credential-based entry deserves particular attention because stolen accounts can bypass controls that focus only on malware files. DeepStrike’s analysis of compromised credentials provides broader context, but each organization should base detection thresholds on its own identity architecture and normal activity.

LockBit tactics mapped to defensive controls

What Operation Cronos changed

Operation Cronos was an international law-enforcement operation led by the UK National Crime Agency with support from partner authorities. It targeted LockBit’s central infrastructure and participants rather than merely removing one malware sample.

Europol reported that 34 servers were taken down, two people were arrested at the operation’s launch, more than 200 cryptocurrency accounts were frozen, and decryption keys were recovered. By June 2024, the FBI said it possessed more than 7,000 LockBit decryption keys, reflecting a later and broader key count.

Eurojust listed ten operational partner countries: the United Kingdom, France, Germany, Sweden, the Netherlands, the United States, Switzerland, Australia, Canada, and Japan. Arrests also occurred in Poland and Ukraine. Counts can therefore differ when sources count partner countries, operational locations, or arrest jurisdictions.

The NCA obtained control of LockBit’s primary administration environment and public-facing leak infrastructure, along with source code and affiliate intelligence. It also reported finding victim data still stored after a ransom had reportedly been paid, undermining claims that payment guarantees deletion.

This illustrates why law enforcement can substantially reduce a RaaS operation without eliminating reusable ransomware code. It also shows how law enforcement tracks dark-web criminals through infrastructure, accounts, operational mistakes, financial evidence, and international cooperation.

LockBit’s documented impact

LockBit statistics are easy to misstate because official releases used different dates, geographies, and definitions. The following figures should be read separately, not added together.

Claims about LockBit’s percentage of global ransomware should always state the measurement period, dataset, and whether the denominator represents leak-site posts, incidents, detections, or confirmed compromises. No single share is presented here as a permanent measure. See DeepStrike’s separately scoped current ransomware statistics for broader trend context.

Documented cases

Confirmed incidents, leak-site listings, ransom demands, ransom payments, total losses, and recovery costs are different measurements. Business interruption, rebuilding, legal work, notification, and lost revenue can exceed the payment itself; these are addressed separately in DeepStrike’s analysis of ransomware recovery costs.

How to prevent and detect LockBit-related attacks

The final NIST IR 8374 Revision 1, published June 11, 2026, frames ransomware risk across the NIST Cybersecurity Framework 2.0 functions: Govern, Identify, Protect, Detect, Respond, and Recover. The following priorities apply that lifecycle to LockBit-related behavior.

• Protect remote and privileged access. Require phishing-resistant MFA where supported, restrict source networks, retire exposed services that are not essential, and keep emergency access controlled and monitored.
• Remediate exposed vulnerabilities quickly. Maintain accountable internet-facing asset ownership and prioritize vulnerabilities with credible exploitation evidence. Use vulnerability exploitation trends as context, not as a substitute for the organization’s inventory.
• Separate and protect administrative identities. Do not use ordinary user accounts for domain, backup, cloud, security, or hypervisor administration.
• Secure identity infrastructure. Monitor directory policy, privileged-group, authentication, service-account, federation, and MFA changes.
• Segment critical systems. Restrict administrative protocols between user, server, backup, security, and virtualization networks.
• Harden endpoints and servers. Use supported systems, behavioral protection, tamper protection, application control where appropriate, and rapid isolation procedures.
• Protect telemetry. Forward endpoint, identity, network, cloud, backup, and virtualization events to centralized storage that compromised administrators cannot easily alter.
• Monitor administrative tools in context. Tie legitimate remote-management and scripting tools to approved identities, systems, maintenance windows, and change records.
• Watch outbound movement. Detect unusual staging, archiving, cloud transfers, and sustained data flows. Encryption alerts alone cannot identify earlier data theft.
• Secure ESXi and virtualization administration. Isolate management planes, enforce strong identity controls, monitor datastore and VM operations, and limit direct administrative access.
• Isolate backups. Use separate credentials, immutable or offline copies, protected retention, and monitoring of backup-policy changes.
• Test restoration. Verify that applications, identity dependencies, configurations, and business data can be restored not merely that a backup job completed.
• Coordinate response in advance. Define executive, legal, communications, insurance, technical, law-enforcement, and regulatory responsibilities before an incident.

What to do if you find a LockBit ransom note

1. Activate the approved incident-response and crisis-management plans.
2. Isolate affected systems using established procedures while avoiding unnecessary destruction of evidence.
3. Preserve volatile and forensic evidence where feasible, including relevant memory, logs, identity events, network data, notes, and suspicious files.
4. Do not delete the ransom note or malware sample.
5. Identify affected identities, endpoints, servers, cloud resources, hypervisors, security systems, and backup infrastructure.
6. Investigate potential data collection and exfiltration not only encryption.
7. Determine whether attackers still have access and whether persistence or unauthorized credentials remain.
8. Contact the appropriate law-enforcement or national cyber authority.
9. Involve qualified forensic responders, legal counsel, the insurer, executive leadership, and communications personnel.
10. Assess contractual, regulatory, privacy, labor, sectoral, and cross-border notification duties by jurisdiction.
11. Check recognized official decryption resources from an isolated analysis environment.
12. Restore only after containment, eradication, identity remediation, and validation of the recovery environment.
13. Rotate affected credentials and secrets according to evidence and dependency-aware procedures.
14. Record evidence, decisions, timing, approvals, and communications.

Do not execute a decryptor or suspected malware directly on production systems. CISA maintains an official ransomware response checklist, but the exact sequence should be adapted by the organization’s incident commander and responders.

Does the LockBit decryptor work?

It may work for some LockBit 3.0 victims, but it is not a universal LockBit recovery tool.

No More Ransom’s official tool directory lists a LockBit 3.0 decryptor developed by the Japanese police. Eligibility depends on the ransomware version, the recovered keys, how encryption occurred, the condition of affected files, and available evidence.

Even successful decryption does not:

• Establish that the attacker no longer has access.
• Remove persistence or unauthorized accounts.
• Reverse confirmed data theft.
• Prove that stolen data was deleted.
• Restore damaged applications or configurations.
• Replace credential rotation and forensic investigation.
• Resolve legal, contractual, regulatory, or notification questions.
• Validate that restored systems are safe to return to service.

Victims should work with qualified responders and test recovery on controlled copies before making production changes.

Should a LockBit victim pay the ransom?

There is no safe, universal answer that can be reduced to an SEO yes-or-no. Payment is a legal, sanctions, operational, ethical, insurance, and business-continuity decision that must be assessed for the specific victim and jurisdiction.

U.S. authorities strongly discourage ransom payments. Payment offers no guarantee that a working decryptor will be provided, that stolen data will be deleted, or that the victim will not be targeted again. Operation Cronos investigators reported finding victim data retained on LockBit systems even after payment.

The OFAC ransomware advisory warns that payments involving sanctioned persons or jurisdictions may create sanctions exposure. Identifying the real counterparty can also be difficult. Other jurisdictions impose their own requirements.

Affected organizations should involve legal counsel, law enforcement, their insurer, incident-response professionals, and sanctions specialists. Insurance coverage or business pressure does not itself make a payment lawful or effective. DeepStrike’s ransomware payment trends provide aggregate context but cannot determine the correct action in an individual incident.

How to validate ransomware readiness safely

• External attack-surface assessment inventories exposed services, forgotten assets, weak access paths, and ownership gaps.
• Vulnerability management identifies and remediates weaknesses continuously rather than at one test date.
• Penetration testing can validate exploitable entry paths and whether scoped controls resist realistic attack chains.
• Identity and Active Directory assessment examines privilege paths, administrative separation, credential exposure, and directory resilience.
• Segmentation testing determines whether a compromised system can reach critical management, backup, identity, or virtualization assets.
• Cloud and ESXi reviews assess high-impact management planes, roles, authentication, logging, and recovery dependencies.
• Red teaming evaluates multi-stage objectives within an approved scope and risk framework.
• Purple teaming and detection validation test whether known benign actions produce usable alerts and investigative evidence.
• Backup restoration exercises prove whether prioritized services and dependencies can be rebuilt within business requirements.
• Incident-response tabletops test executive decisions, communications, legal escalation, evidence handling, and recovery governance.

Penetration testing can identify exploitable entry paths and control weaknesses. It does not reproduce every stage of a ransomware incident, and it cannot guarantee that LockBit or another group will fail. Testing must be authorized in writing, safely scoped, and coordinated with system owners.

Figure 3. Ransomware readiness depends on validating entry paths, identity controls, movement detection, containment, and recovery not on a single security test.

Source note: Original DeepStrike framework informed by the CISA StopRansomware Guide and NIST IR 8374 Revision 1.

LockBit readiness checklist

Governance

• ☐ A named executive owns ransomware risk.
• ☐ Legal, insurance, communications, technical, and operational responsibilities are documented.
• ☐ High-impact services have defined recovery objectives and dependencies.

External exposure

• ☐ Internet-facing assets have accountable owners.
• ☐ Unnecessary remote services are removed or restricted.
• ☐ Exposed-system remediation is prioritized using exploitation evidence.

Identity

• ☐ Remote and privileged access uses phishing-resistant MFA where supported.
• ☐ Administrative accounts are separate from ordinary user identities.
• ☐ Domain, backup, security, cloud, and virtualization privileges are controlled independently.

Endpoint and server

• ☐ EDR coverage and sensor health are measured.
• ☐ Tamper protection is enabled and exceptions are reviewed.
• ☐ Unsupported systems have documented isolation or replacement plans.

Network

• ☐ User networks cannot freely reach management or backup planes.
• ☐ Administrative protocols are restricted and monitored.
• ☐ Isolation procedures can be performed rapidly and safely.

Cloud and virtualization

• ☐ Hypervisor and cloud-management interfaces are not unnecessarily exposed.
• ☐ Privileged activity is centrally logged.
• ☐ ESXi, vCenter, cloud roles, and service identities receive separate review.

Data exfiltration

• ☐ Significant outbound movement is visible.
• ☐ Sensitive-data locations and approved transfer paths are known.
• ☐ DLP and egress detections are tested with synthetic data.

Backups

• ☐ Backup identities are isolated from production administration.
• ☐ Immutable or offline copies cover prioritized systems.
• ☐ Unauthorized retention changes and deletion attempts generate alerts.

Detection

• ☐ Identity, endpoint, network, cloud, backup, and hypervisor telemetry is centralized.
• ☐ Sensor failure and ingestion gaps are monitored.
• ☐ Alerts have documented triage and containment actions.

Response

• ☐ The incident plan addresses encryption and data theft.
• ☐ Evidence-preservation procedures are documented.
• ☐ Law-enforcement, insurer, counsel, and specialist contacts are current.

Recovery

• ☐ Restoration exercises test complete services and dependencies.
• ☐ Recovery environments are validated before reconnection.
• ☐ Credential and secret rotation is built into recovery planning.

Third parties

• ☐ Critical providers disclose relevant access and incident dependencies.
• ☐ Remote vendor access is restricted, authenticated, and monitored.
• ☐ Contracts address notification, evidence preservation, and recovery cooperation.

Frequently asked questions

What is LockBit ransomware?

LockBit is both a ransomware malware family and the name of a criminal RaaS ecosystem. Its administrators developed the service while affiliates generally conducted victim intrusions.

Who is behind LockBit?

Authorities have identified and charged alleged administrators, developers, and affiliates, including alleged administrator Dmitry Khoroshev. Individual attacks may involve different affiliates, access brokers, infrastructure providers, or unrelated users of leaked code. Official sources do not classify LockBit as state-sponsored.

Is LockBit still active?

LockBit-related code and independently analyzed samples remained relevant as of July 13, 2026. That does not prove that the original operation recovered its pre-Cronos scale, affiliates, or central control.

What is LockBit 5.0, and is it the same as LockBit 4.0?

LockBit 5.0 is a later generation analyzed across Windows, Linux, and ESXi. “LockBit 4.0” was associated with criminal release claims and an in-development NG-Dev sample. NG-Dev showed development activity but not broad 4.0 deployment.

What happened during Operation Cronos?

Authorities seized or disrupted infrastructure, recovered source code and decryption keys, obtained affiliate intelligence, froze accounts, and supported arrests, charges, and sanctions. The operation did not eliminate copied code or every participant.

Is there a free LockBit decryptor?

An official LockBit 3.0 decryptor is available through No More Ransom. It only helps eligible incidents and should be evaluated with qualified responders in a controlled environment.

Can penetration testing prevent a LockBit attack?

No. A penetration test can identify exploitable paths and control weaknesses within its scope and test period. Readiness also requires identity security, detection, segmentation, backups, incident response, recovery, legal preparation, and governance.

Should a victim pay a LockBit ransom?

Authorities discourage payment, and it does not guarantee decryption or deletion of stolen data. Sanctions and other legal risks may apply. Victims should obtain incident-specific advice from counsel, law enforcement, their insurer, qualified responders, and sanctions specialists.

Conclusion

LockBit is best understood as an evolving criminal ecosystem rather than one binary or intrusion team. Developers, administrators, affiliates, infrastructure providers, access sellers, and users of leaked code can all produce different evidence and different levels of attribution confidence.

Operation Cronos substantially disrupted that ecosystem, but takedowns do not erase reusable code. Similarly, a decryptor can help some victims without resolving data theft, persistence, identity compromise, legal duties, or recovery integrity.

Organizations should validate exposed entry paths, identity security, segmentation, telemetry, containment, backups, restoration, and executive response as connected capabilities. If your organization needs to test whether those controls withstand authorized, realistic attack paths, consider a properly scoped engagement through DeepStrike’s penetration testing services.

About the author

Mohammed Khalil is a Cybersecurity Architect at DeepStrike. He writes about penetration testing, red teaming and operational resilience. This guide was developed from primary ECB and EU sources and does not replace legal advice or instructions from the relevant authority.