LockBit 3.0 Ransomware
The most prolific ransomware-as-a-service operation of 2022–2024. Infrastructure disrupted in Operation Cronos (February 2024) but activity continues. Analysis based on 43 negotiation transcripts.
The most prolific ransomware-as-a-service operation of 2022–2024. Infrastructure disrupted in Operation Cronos (February 2024) but activity continues. Analysis based on 43 negotiation transcripts.
LockBit emerged in 2019 (originally as ABCD ransomware) and evolved through multiple iterations to become the most prolific ransomware operation globally by 2022. LockBit 3.0 (also known as LockBit Black), released in June 2022, incorporated code from the BlackMatter ransomware and introduced significant capability enhancements including a bug bounty programme, an expanded affiliate model, and StealBit — a custom data exfiltration tool. At its peak, LockBit was responsible for approximately 25–30% of all recorded ransomware incidents globally.
LockBit operated as a Ransomware-as-a-Service (RaaS) platform, with a core development team providing the encryptor, infrastructure, negotiation portal, and data leak site to a large and diverse network of affiliates. This RaaS model meant that the quality and character of individual attacks varied significantly — determined largely by the affiliate rather than the core LockBit team. Our 43 transcripts reflect this variation, showing marked differences in negotiation approach, professionalism, and flexibility across engagements.
In February 2024, Operation Cronos — a coordinated law enforcement action involving the UK NCA, US FBI, Europol, and agencies from 10 additional countries — seized LockBit's infrastructure, including its data leak site, negotiation portals, and backend servers. Approximately 200 cryptocurrency accounts were frozen. LockBit's administrator, operating under the handle "LockBitSupp," was subsequently identified as Dmitry Khoroshev, a Russian national who was sanctioned by the UK, US, and Australia. Despite the disruption, LockBit resurfaced with new infrastructure within days, and affiliate activity continued, demonstrating the resilience of decentralised RaaS models to law enforcement intervention.
LockBit affiliates employed an exceptionally broad range of initial access techniques, reflecting the diverse skill sets and preferences across the affiliate base. The most commonly documented entry vectors in our transcript and forensic data include:
Post-compromise, LockBit affiliates typically deployed Cobalt Strike for command and control, conducted Active Directory reconnaissance using tools such as BloodHound and SharpHound, and used legitimate remote management software (AnyDesk, TeamViewer) to maintain persistent access before encryption.
LockBit 3.0 represented a significant technical leap over its predecessors. The encryptor was largely rebuilt incorporating elements of BlackMatter's codebase, and introduced several notable features:
Encrypted files received extensions varying by affiliate configuration. Volume Shadow Copies were deleted, Windows Event Logs were cleared, and system recovery options were disabled prior to or during the encryption phase.
LockBit's negotiation behaviour was among the most variable of any major ransomware group, driven by the affiliate model. Our 43 transcripts include engagements ranging from highly professional, businesslike negotiations to aggressive, abusive exchanges — reflecting the wide spectrum of affiliate capabilities and approaches.
Initial demands ranged from tens of thousands of dollars for small business victims to hundreds of millions for large enterprises — the Royal Mail negotiation in our archive involved a £66M initial demand. The most significant indicator of likely negotiation outcome was which affiliate was operating the campaign: some affiliates consistently offered early discounts in exchange for prompt payment, while others maintained rigid positions and escalated quickly to data publication threats.
The LockBit platform provided affiliates with a standard negotiation portal accessible to victims via Tor, and a separate chat system for affiliate-operator communication. Timer-based pressure mechanisms were prominently displayed, counting down to data publication on the public leak site. In practice, our transcript data shows these timers were frequently extended — data publication was used as a threat more than an action.
A crucial lesson from our LockBit transcript archive: OFAC/OFSI sanctions screening is mandatory before engaging with any LockBit affiliate. Several LockBit affiliates have been specifically sanctioned, and the existence of a LockBit negotiation portal does not guarantee payment is permissible.
LockBit's victim list includes some of the most high-profile ransomware incidents on record. Among the most significant:
The February 2024 law enforcement disruption temporarily reduced LockBit's operational tempo but did not end the group. Within days of the NCA takeover of their infrastructure, LockBit's administrator announced new infrastructure and invited affiliates to continue. Throughout 2024 and into 2025, LockBit-affiliated activity continued to be recorded, though at a reduced volume compared to the group's 2022–2023 peak. Several legacy LockBit variants and the LockBit 3.0 encryptor (whose builder was leaked in 2022) continued to be used by different actors.
43 LockBit 3.0 negotiation transcripts are available in our public archive, including the full Royal Mail vs LockBit exchange.
| Status | DISRUPTED |
| First Observed | 2019 (LockBit 3.0: 2022) |
| Transcripts | 43 |
| Demand Range | $50K – £66M+ |
| Model | RaaS, Double Extortion |
| Primary Targets | All sectors, all sizes |
| Entry Vectors | Multiple (affiliate-dependent) |
| Disruption | Operation Cronos, Feb 2024 |
| Administrator | Dmitry Khoroshev (sanctioned) |
| Tone | Highly variable (affiliate-dependent) |
| Negotiability | Variable |
| Timeline Pressure | High (countdown timers) |
| Data Leak Threat | Active (LockBit leak site) |
| Sanctions Risk | HIGH — screen before engaging |
If LockBit has targeted your organisation, contact Binary Response immediately. Our team has direct experience with LockBit incidents including sanctions screening, negotiation strategy, and technical recovery.
Get Emergency Help