MITRE ATT&CKsoftware (malware)

S1202 LockBit 3.0

Published 2025-02-05 Modified 2025-10-21 Official page ↗
Domain
enterprise
Platforms
Windows
Aliases
LockBit Black
Version
1.1
Created
2025-02-05

Description

LockBit 3.0 is an evolution of the LockBit Ransomware-as-a-Service (RaaS) offering with similarities to BlackMatter and BlackCat ransomware. LockBit 3.0 has been in use since at least June 2022 and features enhanced defense evasion and exfiltration tactics, robust encryption methods for Windows and VMware ESXi systems, and a more refined RaaS structure over its predecessors such as LockBit 2.0.

Related

Uses · MITRE ATT&CK (34)

  • T1685 Disable or Modify Tools technique
  • T1685.005 Clear Windows Event Logs sub-technique
  • T1688 Safe Mode Boot technique
  • T1680 Local Storage Discovery technique
  • T1480.002 Mutual Exclusion sub-technique
  • T1027.013 Encrypted/Encoded File sub-technique
  • T1622 Debugger Evasion technique
  • T1614.001 System Language Discovery sub-technique
  • T1484.001 Group Policy Modification sub-technique
  • T1573.001 Symmetric Cryptography sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1132.001 Standard Encoding sub-technique
  • T1078.003 Local Accounts sub-technique
  • T1569.002 Service Execution sub-technique
  • T1059.001 PowerShell sub-technique
  • T1021.002 SMB/Windows Admin Shares sub-technique
  • T1027.002 Software Packing sub-technique
  • T1070.004 File Deletion sub-technique
  • T1548.002 Bypass User Account Control sub-technique
  • T1547.004 Winlogon Helper DLL sub-technique
  • T1218.003 CMSTP sub-technique
  • T1543.003 Windows Service sub-technique
  • T1490 Inhibit System Recovery technique
  • T1489 Service Stop technique
  • T1486 Data Encrypted for Impact technique
  • T1480 Execution Guardrails technique
  • T1135 Network Share Discovery technique
  • T1140 Deobfuscate/Decode Files or Information technique
  • T1057 Process Discovery technique
  • T1082 System Information Discovery technique
Show all 34 ›

References