FBI Lockbit 2.0 FEB 2022

StealBit can upload data and files to the LockBit victim-shaming site.

LockBit 2.0 can determine if a running process has administrative privileges and terminate processes that interfere with encryption or exfiltration.

LockBit 2.0 can use the PowerShell module `InvokeGPUpdate` to modify Group Policy.

LockBit 2.0 can use the Windows command shell for multiple post-compromise actions on objective.

LockBit 2.0 can delete itself from disk after execution.

StealBit can self-delete its executable file from the compromised system.

StealBit can use HTTP to exfiltrate files to actor-controlled infrastructure.

LockBit 2.0 can enumerate system information including hostname and domain information.

StealBit can be configured to exfiltrate specific file types.

LockBit 2.0 can exclude files associated with core system functions from encryption.

LockBit 2.0 can create Registry keys to bypass UAC and for persistence.

LockBit 2.0 has the ability to identify mounted external storage devices.

LockBit 2.0 can discover remote shares.

LockBit 2.0 can decode scripts and strings in loaded modules.

StealBit can deobfuscate loaded modules prior to execution.

LockBit 2.0 will not execute on hosts where the system language is set to a language spoken in the Commonwealth of Independent States region.

LockBit 2.0 can modify Group Policy to disable Windows Defender and to automatically infect devices in Windows domains.

LockBit 2.0 has the ability to delete volume shadow copies on targeted hosts.

LockBit 2.0 can use a Registry Run key to establish persistence at startup.

LockBit 2.0 can bypass UAC through creating the Registry key `HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\ICM\Calibration`.

LockBit 2.0 can check if a targeted machine is using a set of Eastern European languages and exit without infection if so.

LockBit 2.0 can enumerate local drive configuration.

LockBit 2.0 can disable firewall rules and anti-malware and monitoring software including Windows Defender.

LockBit 2.0 can delete log files through the use of wevtutil.