MITRE ATT&CKsoftware (malware)
S1199 LockBit 2.0
- Domain
- enterprise
- Platforms
- Windows
- Version
- 1.1
- Created
- 2025-01-24
Description
LockBit 2.0 is an affiliate-based Ransomware-as-a-Service (RaaS) that has been in use since at least June 2021 as the successor to LockBit Ransomware. LockBit 2.0 has versions capable of infecting Windows and VMware ESXi virtual machines, and has been observed targeting multiple industry verticals globally.
Related
Uses · MITRE ATT&CK (26)
- T1685 Disable or Modify Tools technique
- T1685.005 Clear Windows Event Logs sub-technique
- T1680 Local Storage Discovery technique
- T1614.001 System Language Discovery sub-technique
- T1484.001 Group Policy Modification sub-technique
- T1564.003 Hidden Window sub-technique
- T1059.001 PowerShell sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1021.002 SMB/Windows Admin Shares sub-technique
- T1070.004 File Deletion sub-technique
- T1548.002 Bypass User Account Control sub-technique
- T1547.001 Registry Run Keys / Startup Folder sub-technique
- T1053.005 Scheduled Task sub-technique
- T1490 Inhibit System Recovery technique
- T1489 Service Stop technique
- T1486 Data Encrypted for Impact technique
- T1480 Execution Guardrails technique
- T1135 Network Share Discovery technique
- T1136 Create Account technique
- T1140 Deobfuscate/Decode Files or Information technique
- T1047 Windows Management Instrumentation technique
- T1057 Process Discovery technique
- T1082 System Information Discovery technique
- T1083 File and Directory Discovery technique
- T1112 Modify Registry technique
- T1120 Peripheral Device Discovery technique
References
- https://unit42.paloaltonetworks.com/lockbit-2-ransomware/ Palo Alto Lockbit 2.0 JUN 2022
- https://www.ic3.gov/CSA/2022/220204.pdf FBI Lockbit 2.0 FEB 2022