Banned, Rebranded, Still Ransoming: How LockBit Outlasted Its Own Takedown

Written by Nick Thanos | Jul 31, 2026, 2:04:37 AM

Prepared by: Nick Thanos | Published: 30 July 2026

Threat actor profile: LockBit

Threat actor status: ACTIVE

Since first appearing in September 2019 under the name "ABCD," LockBit has grown into one of the most prolific ransomware operations in the world, targeting organisations across healthcare, finance, manufacturing, education and government. Active globally and observed directly by Triskele Labs across eleven incident response engagements in Australia, the group operates under a ransomware-as-a-service (RaaS) model and has built a reputation for speed, customisation and reliability that keeps it a preferred choice for affiliates across the ransomware ecosystem.

LockBit: Background

LockBit first appeared in September 2019 under the name "ABCD" and has since rebranded twice, first as LockBit 2.0 in 2021 and later as LockBit 3.0 in mid-2022. Under its ransomware-as-a-service model, the group provides affiliates with access to its encryption and decryption tools, backend portals and technical support in exchange for a share of ransom payments.

LockBit is best known for double extortion, exfiltrating data before encrypting victim environments and leveraging the threat of public leaks to pressure payment. In some cases, affiliates have gone further still, layering on triple extortion by threatening distributed denial-of-service (DDoS) attacks or contacting a victim's customers and business partners directly.

The group has predominantly targeted organisations in the United States, the United Kingdom, Germany, France and Australia. Its activity surged following the outbreak of the Russia-Ukraine conflict, and it has consistently ranked among the most active ransomware operators worldwide. Despite law enforcement crackdowns and occasional leaks of its builder tools, LockBit has shown resilience, regularly adapting its infrastructure and continuing to expand its affiliate base.

How LockBit Operates

Across the eleven incidents responded to by Triskele Labs, a consistent and methodical pattern of compromise emerged.

Initial Access: VPN, RDP and Weak Credential Exploitation

LockBit affiliates rely heavily on exploiting external-facing services and weak credentials to gain initial access. This includes exploiting vulnerabilities in VPN appliances and Remote Desktop Protocol (RDP), a Microsoft technology that allows a user to connect to and control a remote computer as though sitting in front of it, alongside brute force and password spraying attacks against exposed services to establish a foothold.

Credential Access: Credential Harvesting with Mimikatz

Once inside, LockBit affiliates use Mimikatz, a post-exploitation tool that extracts plaintext passwords, hashes and Kerberos tickets from Windows memory, to harvest stored credentials after gaining access to the victim network. This escalates their access and supports further movement through the environment.

Discovery: Network and Domain Enumeration

LockBit affiliates map the environment before moving further, using Netscan and Advanced Port Scanner to scan the internal network for live hosts, open ports and potential targets. AdFind, a command-line tool for querying Active Directory, is used to locate domain controllers and gather information about the victim's environment.

Lateral Movement: PsExec and RDP

With domain information and harvested credentials in hand, LockBit affiliates move laterally using PsExec, a remote administration utility that allows attackers to execute processes on other systems without physical access, and RDP itself, reusing the same protocol exploited for initial access to traverse the network.

Persistence: Remote Access Software

LockBit affiliates maintain persistence in compromised environments using remote access software, including tools such as AnyDesk, TightVNC, Splashtop and ScreenConnect, legitimate remote desktop applications repurposed to give attackers ongoing, low-visibility control.

Defence Evasion: Group Policy Abuse

LockBit affiliates weaken endpoint security by modifying or disabling Windows Defender through Group Policy Objects (GPOs), a Windows feature allowing administrators to define and enforce settings across all systems in an organisation from a central location. Abusing GPOs in this way strips out the primary line of endpoint defence across the environment in one action.

Exfiltration: Data Exfiltration via Rclone

Before deploying ransomware, LockBit affiliates exfiltrate sensitive data to maximise leverage for double extortion. Rclone, a command-line tool for managing and syncing files across cloud storage providers, is used to transfer stolen data to public cloud file-sharing services such as MEGAsync or FileZilla.

Impact: Encryption and Extortion Escalation

With data already exfiltrated, LockBit deploys its encryption payload across the environment. Victims are then pressured through double extortion, and in some cases triple extortion, with affiliates threatening DDoS attacks or directly contacting a victim's customers and business partners to increase pressure to pay.

LockBit: Reducing your exposure

The consistent entry points and techniques observed across LockBit engagements mean there are clear, actionable controls that reduce risk materially.

Enforce MFA across all external-facing services without exception.
LockBit's most common entry point is an exposed VPN or RDP service without MFA, often paired with brute force or password spraying. MFA closes off this vector even where credentials have been compromised elsewhere.
Patch VPN and remote access infrastructure promptly.
LockBit affiliates exploit known vulnerabilities in VPN appliances as a primary entry method. A documented patch management programme with defined timelines for critical patches reduces the window of exposure on internet-facing infrastructure.
Restrict and monitor RDP within the internal network.
LockBit uses RDP for both initial access and lateral movement. Limit RDP access to only the systems and accounts that require it, enforce strong authentication for all sessions, and monitor for activity outside normal patterns.
Deploy and maintain EDR across every endpoint and server, with tamper protection enabled.
LockBit affiliates deliberately target Windows Defender through Group Policy abuse. Endpoint Detection and Response (EDR) with tamper protection prevents security tooling from being disabled by an unauthorised process.
Monitor for anomalous use of legitimate remote access and administration tools.
Because LockBit relies on remote access software and administration utilities already trusted in many environments, detection needs to focus on unusual usage patterns, not just known-bad signatures.
Monitor for exfiltration tooling and anomalous outbound data volumes.
LockBit uses Rclone to move stolen data to cloud storage ahead of encryption. Build detections for unexpected use of cloud sync tooling combined with unusual outbound data volumes, particularly outside business hours.
Ensure security alerting is monitored around the clock.
Whether through an internal security operations capability or an external managed detection and response (MDR) provider, continuous monitoring closes the gap between initial access and full encryption.

Summary

LockBit is an active, financially motivated ransomware group operating under a ransomware-as-a-service model since 2019, having rebranded twice to reach its current LockBit 3.0 iteration. Triskele Labs has responded directly to eleven LockBit incidents, the highest engagement count of any group in this series, giving firsthand insight into a consistent pattern: gain initial access through an exposed VPN or RDP service, harvest credentials with Mimikatz, enumerate the network and domain, move laterally via PsExec and RDP, persist using legitimate remote access software, disable Windows Defender through Group Policy abuse, exfiltrate data via Rclone, then encrypt and escalate through double or triple extortion.

The defences most likely to disrupt a LockBit intrusion are foundational: enforce MFA on every external-facing service, patch VPN and remote access infrastructure promptly, restrict RDP internally, and keep EDR tamper-protected and consistently deployed. LockBit's dominance comes from reliability and scale, not technical novelty. It succeeds because the environments it targets have not applied the controls that would stop it at the door.

If your organisation has experienced a LockBit incident or suspects a compromise involving ransomware or data exfiltration, engage your cyber insurer and a reputable DFIR firm promptly.

MITRE ATT&CK Mapping

TACTIC	TECHNIQUE	DESCRIPTION
Resource Development	T1584 - Compromise Infrastructure	Compromise third-party infrastructure that can be used during targeting.
Resource Development	T1608.001 - Stage Capabilities: Upload Malware	Upload malware to third-party or adversary-controlled infrastructure to make it accessible during targeting.
Resource Development	T1608.002 - Stage Capabilities: Upload Tool	Upload tools to third-party or adversary-controlled infrastructure to make it accessible during targeting.
Initial Access	T1078.001 - Valid Accounts: Default Accounts	Default accounts are those built into an OS, such as the Guest or Administrator accounts on Windows systems.
Initial Access	T1078.002 - Valid Accounts: Domain Accounts	Obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defence Evasion.
Initial Access	T1133 - External Remote Services	Leverage external-facing remote services to initially access and/or persist within a network.
Initial Access	T1190 - Exploit Public-Facing Application	Exploit a weakness in an internet-facing host or system to initially access a network.
Execution	T1059.001 - Command and Scripting Interpreter: PowerShell	Abuse PowerShell commands and scripts for execution.
Execution	T1059.003 - Command and Scripting Interpreter: Windows Command Shell	Abuse the Windows command shell for execution.
Execution	T1204.002 - User Execution: Malicious File	Rely upon a user opening a malicious file to gain execution.
Persistence	T1053.005 - Scheduled Task/Job: Scheduled Task	A scheduled task was created to execute a malicious program or code.
Persistence	T1078 - Valid Accounts	Obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defence Evasion.
Persistence	T1078.002 - Valid Accounts: Domain Accounts	Obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defence Evasion.
Persistence	T1078.003 - Valid Accounts: Local Accounts	Obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defence Evasion.
Persistence	T1133 - External Remote Services	Leverage external-facing remote services to initially access and/or persist within a network.
Persistence	T1136.001 - Create Account: Local Account	Create a local account to maintain access to victim systems.
Persistence	T1136.002 - Create Account: Domain Account	Create a domain account to maintain access to victim systems.
Persistence	T1197 - BITS Jobs	Abuse BITS jobs to persistently execute code and perform various background tasks.
Persistence	T1543.003 - Create or Modify System Process: Windows Service	Create or modify Windows services to repeatedly execute malicious payloads as part of persistence.
Privilege Escalation	T1037 - Boot or Logon Initialization Scripts	Use scripts automatically executed at boot or logon to establish persistence.
Privilege Escalation	T1068 - Exploitation for Privilege Escalation	Exploit software vulnerabilities to elevate privileges.
Privilege Escalation	T1543 - Create or Modify System Process	Create or modify system-level processes to repeatedly execute malicious payloads as part of persistence.
Privilege Escalation	T1547 - Boot or Logon Autostart Execution	Configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges.
Defence Evasion	T1070 - Indicator Removal	Delete or modify artefacts generated within systems to remove evidence of their presence or hinder defences.
Defence Evasion	T1070.001 - Indicator Removal: Clear Windows Event Logs	Clear Windows Event Logs to hide the activity of an intrusion.
Defence Evasion	T1211 - Exploitation for Defence Evasion	Exploit a system or application vulnerability to bypass security features.
Defence Evasion	T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification	Modify file or directory permissions and attributes to evade access control lists and access protected files.
Defence Evasion	T1550.002 - Use Alternate Authentication Material: Pass the Hash	Use stolen password hashes to move laterally within an environment, bypassing normal system access controls.
Defence Evasion	T1562 - Impair Defences	Maliciously modify components of a victim environment to hinder or disable defensive mechanisms.
Defence Evasion	T1562.001 - Impair Defences: Disable or Modify Tools	Modify and/or disable security tools to avoid possible detection of their malware and activities.
Defence Evasion	T1564 - Hide Artifacts	Attempt to hide artefacts associated with their behaviour to evade detection.
Credential Access	T1003 - OS Credential Dumping	Attempt to dump credentials to obtain account login and credential material.
Credential Access	T1003.001 - OS Credential Dumping: LSASS Memory	Attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).
Credential Access	T1003.003 - OS Credential Dumping: NTDS	Attempt to access or create a copy of the Active Directory domain database to steal credential information.
Credential Access	T1003.006 - OS Credential Dumping: DCSync	Attempt to access credentials and other sensitive information by abusing a Windows Domain Controller's API.
Credential Access	T1078.002 - Valid Accounts: Domain Accounts	Obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defence Evasion.
Credential Access	T1110 - Brute Force	Use brute force techniques to gain access to accounts when passwords are unknown or hashes are obtained.
Credential Access	T1110.002 - Brute Force: Password Cracking	Attempt to recover usable credentials, such as plaintext passwords, when credential material such as password hashes are obtained.
Credential Access	T1555 - Credentials from Password Stores	Search for common password storage locations to obtain user credentials.
Credential Access	T1552 - Unsecured Credentials	Search compromised systems to find and obtain insecurely stored credentials.
Discovery	T1018 - Remote System Discovery	Attempt to get a listing of other systems by IP address, hostname, or other logical identifier that may be used for Lateral Movement.
Discovery	T1033 - System Owner/User Discovery	Attempt to identify the primary user, currently logged in user, or set of users that commonly use a system.
Discovery	T1046 - Network Service Discovery	Attempt to get a listing of services running on remote hosts and local network infrastructure devices.
Discovery	T1069 - Permission Groups Discovery	Attempt to discover group and permission settings.
Discovery	T1069.002 - Permission Groups Discovery: Domain Groups	Attempt to find domain-level groups and permission settings.
Discovery	T1083 - File and Directory Discovery	Enumerate files and directories or search specific locations of a host or network share for information.
Discovery	T1087 - Account Discovery	Attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment.
Discovery	T1087.002 - Account Discovery: Domain Account	Attempt to get a listing of domain accounts.
Discovery	T1135 - Network Share Discovery	Look for folders and drives shared on remote systems as a means of identifying sources of information to gather.
Discovery	T1482 - Domain Trust Discovery	Attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities.
Discovery	T1615 - Group Policy Discovery	Gather information on Group Policy settings to identify paths for privilege escalation and security measures applied within a domain.
Lateral Movement	T1021.002 - Remote Services: SMB/Windows Admin Shares	Use valid accounts to interact with a remote network share using Server Message Block (SMB).
Lateral Movement	T1550.002 - Use Alternate Authentication Material: Pass the Hash	Use stolen password hashes to move laterally within an environment, bypassing normal system access controls.
Lateral Movement	T1570 - Lateral Tool Transfer	Transfer tools or other files between systems in a compromised environment.
Collection	T1005 - Data from Local System	Search local system sources to find files of interest and sensitive data prior to exfiltration.
Collection	T1039 - Data from Network Shared Drive	Data was collected from shared network drives.
Collection	T1119 - Automated Collection	Use automated techniques for collecting internal data once established within a system or network.
Command and Control	T1090 - Proxy	Use a connection proxy to direct network traffic between systems or act as an intermediary for command-and-control communications.
Command and Control	T1105 - Ingress Tool Transfer	Transfer tools or other files from an external system into a compromised environment.
Command and Control	T1132.001 - Data Encoding: Standard Encoding	Encode data with a standard data encoding system to make command-and-control traffic harder to detect.
Command and Control	T1219 - Remote Access Software	Use legitimate remote access tools to establish an interactive command and control channel within a network.
Command and Control	T1572 - Protocol Tunnelling	Tunnel network communications within a separate protocol to avoid detection or filtering, or to enable access to otherwise unreachable systems.
Exfiltration	T1041 - Exfiltration Over C2 Channel	Steal data by exfiltrating it over an existing command and control channel.
Exfiltration	T1048 - Exfiltration Over Alternative Protocol	Steal data by exfiltrating it over a different protocol than that of the existing command and control channel.
Exfiltration	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol	Steal data by exfiltrating it over an unencrypted network protocol other than the existing command and control channel.
Impact	T1486 - Data Encrypted for Impact	Encrypt data on target systems to interrupt availability to system and network resources.
Impact	T1490 - Inhibit System Recovery	Delete or remove built-in data and turn off services designed to aid recovery of a corrupted system.

Common Utilised Tooling

TOOL	PURPOSE
Mimikatz	Post-exploitation tool used to extract plaintext passwords, hashes and Kerberos tickets from Windows memory.
PsExec	Remote administration utility that allows attackers to execute processes on other systems without physical access.
Fgdump	Windows credential dumping tool often used to extract password hashes from the Security Account Manager (SAM) database.
LaZagne	Open-source tool designed to recover stored credentials from browsers, email clients and other applications.
Ngrok	Tunnelling service that enables remote access to internal systems by exposing local services to the internet.
AnyDesk	Legitimate remote desktop software frequently abused by threat actors to maintain persistent access to compromised systems.
TightVNC	Free remote desktop application that allows remote viewing and control, often exploited for unauthorised system access.
Splashtop	Commercial remote access solution that can be weaponised to give attackers covert control over victim environments.
ScreenConnect	Remote desktop and support tool leveraged by adversaries for persistent access and lateral movement.
ARestore	Utility designed to recover or restore files, which can be misused to retrieve deleted data or aid recovery bypass.
Rclone	Command-line tool for managing and syncing files across cloud storage providers, widely used for data exfiltration.
Netscan / Advanced Port Scanner	Network scanning tools used to identify live hosts, open ports and potential targets within a victim environment.
AdFind	Command-line Active Directory query tool used to locate domain controllers and gather environment information.