Nits Among Your Bits: A Dive into LockBit Ransomware Operations

Oleg Skulkin, head of a DFIR team at Group-IB, examines how LockBit affiliates operate inside victim networks, from first foothold to encryption. He starts with the ransomware-as-a-service model, the group's activity since 2019, and the LockBit 2.0 update from mid-2021, noting that affiliates have carried out a large number of attacks in a short time.

The middle of the talk covers the intrusion lifecycle. Initial access usually comes through compromised VPN credentials or exposed RDP accounts, with some exploitation of public-facing applications. Affiliates then disable antivirus and use rootkit-detection tools to evade defenses, wipe staging folders and clear event logs, and dump credentials with Mimikatz and similar utilities. Reconnaissance relies on network scanners, credential checkers, BloodHound and SharpHound. Lateral movement uses RDP, PsExec, Cobalt Strike and SSH into Linux hosts, and Cobalt Strike beacons are often left on a few servers for redundant access. Data is staged with tools such as FileZilla and WinSCP, and the custom StealBit tool automates exfiltration with configurable limits and exclusions.

The closing section covers deployment. Affiliates copy the encryptor over RDP, run it through PsExec, or push it via Group Policy scheduled tasks. LockBit 2.0 removes shadow copies, encrypts files with AES-128 in CBC mode, can reach network shares, and may stop services and disable Windows Defender. For responders, the practical takeaway is to hunt for these tools, commands and leftover beacons across many hosts, and to tune detections to the affiliate behaviors described.