Malware.View on attack.mitre.org
LockBit 3.0 is an evolution of the LockBit Ransomware-as-a-Service (RaaS) offering with similarities to BlackMatter and BlackCat ransomware. LockBit 3.0 has been in use since at least June 2022 and features enhanced defense evasion and exfiltration tactics, robust encryption methods for Windows and VMware ESXi systems, and a more refined RaaS structure over its predecessors such as LockBit 2.0.
| Technique | Procedure example |
|---|---|
| T1021.002 SMB/Windows Admin Shares |
LockBit 3.0 can use SMB for lateral movement. |
| T1027.002 Software Packing |
LockBit 3.0 can use code packing to hinder analysis. |
| T1027.013 Encrypted/Encoded File |
The LockBit 3.0 payload includes an encrypted main component. |
| T1057 Process Discovery |
LockBit 3.0 can identify and terminate specific services. |
| T1059.001 PowerShell |
LockBit 3.0 can use PowerShell to apply Group Policy changes. |
| T1070.004 File Deletion |
LockBit 3.0 can delete itself from disk. |
| T1071.001 Web Protocols |
LockBit 3.0 can use HTTP to send victim host information to C2. |
| T1078.003 Local Accounts |
LockBit 3.0 can use a compromised local account for lateral movement. |
| T1082 System Information Discovery |
LockBit 3.0 can enumerate system hostname and domain. |
| T1083 File and Directory Discovery |
LockBit 3.0 can exclude files associated with core system functions from encryption. |
| T1106 Native API |
LockBit 3.0 has the ability to directly call native Windows API items during execution. |
| T1112 Modify Registry |
LockBit 3.0 can change the Registry values for Group Policy refresh time, to disable SmartScreen, and to disable Windows Defender. |
| T1120 Peripheral Device Discovery |
LockBit 3.0 has the ability to discover external storage devices. |
| T1132.001 Standard Encoding |
LockBit 3.0 can Base64-encode C2 communication. |
| T1135 Network Share Discovery |
LockBit 3.0 can identify network shares on compromised systems. |
None recorded.
None recorded.
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
