Introduction: Understanding the LockBit Threat

Ransomware incidents can cause significant operational disruption, but the encryption stage is often only the final part of a much larger intrusion.

LockBit became known for operating a ransomware-as-a-service model, in which developers maintained the ransomware platform while affiliates conducted attacks against selected organizations. This structure allowed different operators to use shared ransomware capabilities while employing different methods to gain access to victims.

LockBit attacks have affected organizations across sectors, including healthcare, manufacturing, professional services, and government-related environments. The precise techniques used vary by incident, affiliate, and target.

The operation has also been the subject of international law-enforcement action. In February 2024, an international operation known as Operation Cronos disrupted parts of LockBit's infrastructure and seized services used by the group. Such disruption did not, by itself, establish that every affiliate, copy of the malware, or associated criminal activity had permanently disappeared.

For incident responders, the central challenge is to identify the intrusion that precedes encryption. A LockBit-related alert should trigger investigation into initial access, credential use, lateral movement, possible data theft, and the integrity of recovery systems.

How LockBit Operates

LockBit's ransomware-as-a-service model separates the development of the ransomware from many of the operations used to deploy it.

The developers maintain the platform and its capabilities. Affiliates use those capabilities to conduct intrusions, select targets, and execute attacks. The division of responsibilities means that two incidents attributed to LockBit may have different initial-access methods and different patterns of activity.

A typical operation may involve:

1. Obtaining initial access to a victim's environment.

2. Establishing a foothold and collecting information about the network.

3. Obtaining additional credentials or privileges.

4. Moving to other systems and identifying valuable data.

5. Attempting to interfere with security controls and backups.

6. Exfiltrating sensitive information in some incidents.

7. Deploying ransomware and demanding payment.

This is a common investigative model rather than a fixed sequence. Attackers may skip stages, repeat them, or perform multiple activities in parallel.

Stage 1: Initial Access

Before LockBit can disrupt an environment, the operator or affiliate must obtain access.

Reported ransomware intrusion methods have included compromised credentials, exposed remote-access services, exploitation of vulnerable systems, and phishing. The presence of one of these methods in an incident does not automatically establish that LockBit was responsible.

Common access paths

Compromised credentials: Attackers use stolen passwords, authentication tokens, or other credentials to access legitimate accounts.

Exposed remote services: Poorly secured remote-access infrastructure can provide an entry point into an organization.

Exploitation of vulnerabilities: Unpatched internet-facing systems may allow attackers to obtain unauthorized access.

Phishing and social engineering: Users may be manipulated into disclosing credentials or executing malicious content.

SOC investigation

Start by identifying the earliest suspicious event and determining how the attacker entered the environment.

Review identity-provider logs, VPN records, firewall telemetry, email security events, and endpoint alerts. Look for unusual successful logins, repeated authentication failures, unfamiliar source addresses, suspicious remote sessions, and unexpected account activity.

Establish whether the initial access was followed by new processes, privilege changes, or access to additional systems. These relationships can help distinguish an isolated authentication anomaly from the beginning of a broader intrusion.

Stage 2: Execution and Persistence

After gaining access, attackers may execute tools or commands that allow them to interact with the compromised system.

They may also attempt to maintain access so that they can return even if the original entry point is closed. Persistence mechanisms can include unauthorized scheduled tasks, services, startup changes, or modifications to accounts and permissions.

The exact mechanisms vary. Not every LockBit incident includes the same persistence techniques, and some attackers may operate through already compromised accounts without installing a persistent implant.

SOC investigation

Examine process trees, command-line telemetry, scheduled-task changes, service creation, and unusual account modifications.

On Windows systems, potentially relevant events include:

• Security Event ID 4688: Process creation, when the appropriate auditing is enabled.

• System Event ID 7045: A service was installed.

• Security Event ID 4697: A service was installed, when the relevant audit policy records it.

• Security Event ID 4720: A user account was created.

These events provide investigative context rather than proof of ransomware. Correlate them with the initiating account, parent process, source endpoint, and surrounding activity.

Stage 3: Privilege Escalation and Credential Access

An attacker who initially compromises a standard user account may attempt to obtain stronger privileges or credentials for additional systems.

Credential access can involve abuse of stored credentials, attempts to obtain authentication material, or misuse of accounts that already have elevated permissions.

Privilege escalation refers to obtaining greater permissions, while credential access refers to obtaining or abusing authentication material. They may occur together, but they are distinct investigative activities.

Why this stage matters

Administrative access can allow an attacker to affect multiple endpoints, access sensitive servers, change security settings, and interfere with recovery infrastructure.

A single compromised privileged account can significantly increase the potential impact of a ransomware incident.

SOC investigation

Investigate unexpected privileged logons, suspicious account-group changes, and unusual access to credential-sensitive processes or resources.

Relevant Windows events may include:

• 4624: Successful logon.

• 4625: Failed logon.

• 4672: Special privileges assigned to a new logon.

• 4728: A member was added to a security-enabled global group.

• 4732: A member was added to a security-enabled local group.

Correlate these events with identity logs and endpoint telemetry. Determine whether privileged access aligns with normal administrative activity or follows a suspicious initial-access event.

Stage 4: Discovery and Lateral Movement

Once an attacker has a foothold, they may explore the environment to identify valuable systems and determine where their credentials work.

Discovery may involve identifying domain information, users, servers, shared folders, security tools, and backup infrastructure.

Lateral movement occurs when the attacker uses access from one system to reach another. This may involve legitimate remote-administration mechanisms, which can make malicious activity difficult to distinguish from normal IT operations.

In a ransomware incident, lateral movement can turn a single compromised endpoint into a threat to a large portion of the organization.

SOC investigation

Correlate authentication and endpoint events across multiple systems.

Look for:

• Accounts authenticating to servers they do not normally access.

• Unusual remote logons and administrative sessions.

• Unexpected access to file shares.

• Suspicious remote process execution.

• Rapid changes in the number of systems accessed by one account.

• Similar command or process activity across multiple endpoints.

The key question is whether the activity forms a connected sequence of unauthorized access rather than several unrelated administrative events.

Stage 5: Defense Evasion and Security Control Tampering

Ransomware operators may attempt to weaken security controls before deploying the payload.

Potential actions include modifying endpoint protection settings, stopping security-related services, interfering with logging, or using tools intended to reduce the likelihood of detection.

Attackers may also attempt to weaken backup and recovery capabilities. This can make the organization more dependent on restoring data from whatever recovery copies remain available.

These activities are not unique to LockBit, and legitimate system administrators sometimes make similar changes. Context is essential.

SOC investigation

Investigate unexplained changes to endpoint protection, audit policies, security services, and backup configurations.

Correlate changes with the responsible account, source host, command line, and previous alerts.

An unexpected attempt to disable endpoint protection followed by unusual activity across multiple servers should be treated as a potentially urgent incident, even if no encryption has started.

Stage 6: Data Discovery and Exfiltration

Some ransomware incidents involve data theft before encryption. This creates a second source of pressure on the victim: the threat that stolen information will be published or disclosed.

LockBit has been associated with data-theft and extortion activity, but data exfiltration must be established separately in each investigation. Encryption alone does not prove that data was stolen.

The information at risk can include business records, customer data, financial information, intellectual property, and internal communications.

SOC investigation

Look for unusual access to sensitive directories, unexpected file staging, abnormal outbound transfers, and connections to unfamiliar external destinations.

Correlate network activity with the process responsible for the transfer, the account involved, and the data accessed.

Large transfers alone are not conclusive evidence of exfiltration. Legitimate backups, cloud synchronization, and business operations can generate similar traffic.

If data theft is suspected, preserve relevant evidence and assess which systems and data sets may have been accessed.

Stage 7: Backup Targeting and Recovery Inhibition

Backups are essential to ransomware recovery, so attackers may attempt to locate or disrupt them.

Potential targets include backup-management servers, snapshots, recovery accounts, and storage systems containing protected copies of business data.

If production systems and recovery infrastructure are compromised together, restoration can become significantly more difficult.

SOC investigation

Monitor for unexpected deletion of snapshots, changes to backup retention settings, failed backup jobs, and suspicious access to backup consoles.

Investigate whether these actions were performed by an authorized administrator and whether they occurred after suspicious account or endpoint activity.

Protecting recovery infrastructure separately from ordinary production systems can reduce the likelihood that a single compromised account can affect both.

Stage 8: Ransomware Deployment and Encryption

Encryption is the stage most visibly associated with LockBit.

Depending on the incident, ransomware may execute on individual endpoints, servers, or multiple systems. It can target files, modify file names or extensions, and create ransom notes describing the attackers' demands.

The precise behaviour depends on the ransomware variant and its configuration. Not every incident produces identical file extensions, notes, or execution patterns.

What defenders may observe

• A sudden increase in file modifications.

• Files becoming inaccessible or receiving altered extensions.

• Ransom-note files appearing in affected directories.

• Unusual processes accessing and modifying large numbers of files.

• Similar encryption activity across multiple endpoints or network shares.

• Recovery systems or backups becoming unavailable.

SOC investigation

Treat suspected mass encryption as an emergency. Follow the incident-response plan to isolate affected systems and prevent further spread.

Preserve relevant process, network, and file-system evidence where feasible. Identify the affected endpoints and shared resources, determine whether the activity is still active, and investigate for signs of earlier compromise.

Do not delay containment simply to identify the exact LockBit variant.

Incident Analysis: Connecting the Evidence

Consider a hypothetical investigation in which an organization detects the following sequence:

• An account signs in from an unusual source.

• The account subsequently accesses several servers.

• New administrative activity appears on systems that the user does not normally manage.

• Backup settings are modified unexpectedly.

• Multiple systems begin generating file-modification alerts.

None of the first events alone proves that LockBit is present. However, the sequence suggests a possible progression from compromised access to lateral movement, recovery inhibition, and encryption.

The SOC should correlate the events by timestamp, account, source host, process, and destination system. Investigators should also look for evidence of data theft and determine whether the activity matches a known ransomware family.

This approach is more useful than treating every alert independently because it reconstructs the potential attack chain and identifies where containment could have prevented further impact.

LockBit Incident Response: Recommended Actions

If LockBit activity is suspected, organizations should follow their incident-response procedures and coordinate the SOC, incident-response team, IT operations, legal stakeholders, and relevant business owners.

1. Contain affected systems. Isolate compromised endpoints and servers where appropriate. Restrict suspicious access and prevent further unauthorized movement.

2. Protect identity infrastructure. Investigate compromised accounts, revoke sessions where necessary, and rotate exposed credentials from trusted systems.

3. Preserve evidence. Collect EDR telemetry, authentication records, relevant network logs, ransom notes, and suspicious files according to forensic procedures.

4. Determine the scope. Identify affected systems, shared storage, privileged accounts, and backup infrastructure. Assess whether data exfiltration may have occurred.

5. Protect recovery copies. Prevent unauthorized access to backups and verify that recovery data remains available and trustworthy.

6. Eradicate and recover. Remove attacker access, address the initial entry point, rebuild or clean systems as appropriate, and restore from trusted backups.

7. Monitor for recurrence. Continue monitoring for suspicious authentication, unexpected remote sessions, new persistence mechanisms, and renewed file-modification activity.

Paying a ransom does not guarantee that systems will be restored or that stolen information will remain private. Recovery decisions should be made through the organization's established incident-management and legal processes.

Indicators of Compromise (IOCs) and Detection Notes

LockBit has had multiple versions and associated infrastructure over time. A generic LockBit article cannot provide a reliable, complete list of IP addresses, domains, file hashes, or file extensions that applies to every variant and incident.

The following are behavioural indicators for investigation, not confirmed LockBit-specific IOCs.

Endpoint Indicators

• Unexpected execution of ransomware or suspicious file-encryption processes.

• Rapid modifications to large numbers of files.

• Unexpected creation of ransom-note files.

• Unexplained changes to security services, scheduled tasks, or system configuration.

• Suspicious administrative activity across multiple endpoints.

Identity and Network Indicators

• Unusual privileged logons or account-group changes.

• Unexpected remote access to multiple servers.

• Suspicious access to file shares and backup systems.

• Abnormal outbound data transfers.

• Unexplained changes to backup policies or recovery infrastructure.

Investigation Data to Preserve

For each relevant event, record:

• Timestamp and affected hostname.

• User account and logon type.

• Process name, parent process, and command line where available.

• Source and destination network information.

• Relevant file paths and hashes.

• EDR alert details and associated evidence.

• Whether the behaviour was confirmed malicious, suspicious, or legitimate.

For a live incident, use current, version-specific threat intelligence from trusted sources to obtain validated LockBit indicators. Do not label a file, domain, or IP address as a LockBit IOC without supporting evidence.

Lessons for Security Teams

LockBit incidents reinforce several important defensive principles:

• Secure initial access: Patch exposed systems, protect remote access, and enforce strong authentication.

• Limit privileges: Reduce standing administrative access and monitor privileged accounts.

• Improve visibility: Correlate endpoint, identity, network, and cloud logs in the SIEM.

• Protect backups: Separate recovery infrastructure from ordinary production access and regularly test restoration.

• Detect behaviour early: Investigate credential abuse, lateral movement, and security-control tampering before encryption begins.

• Prepare for data theft: Assess potential exfiltration as well as operational disruption.

Conclusion

LockBit illustrates how ransomware can combine unauthorized access, credential abuse, lateral movement, security-control tampering, and encryption into a coordinated intrusion.

For SOC analysts, the most valuable evidence may appear before the ransom note. Unusual authentication, unexpected administrative activity, suspicious data transfers, and backup tampering can reveal the attack while there is still an opportunity to limit its impact.

The central lesson is to investigate the complete sequence rather than focus exclusively on encrypted files. Effective ransomware defence depends on early detection, rapid containment, protected recovery systems, and a clear understanding of how the attacker gained access and moved through the environment.