OAK-S23 — LockBit ransomware

Description

LockBit is the ransomware encryptor codebase developed and maintained by the LockBitSupp persona (publicly identified May 7, 2024 as Russian national Dmitry Yuryevich Khoroshev) and licensed to an affiliate network under a textbook ransomware-as-a-service model. From its January 2020 LockBit 1.0 debut on Russian-language criminal forums through the February 2024 Operation Cronos disruption, LockBit was the single most prolific RaaS encryptor strain on the public record — DOJ filings document more than 2,000 victim organisations across more than 120 countries and over $120M in attributable extortion revenue. The family is C++-authored across its main version line (1.0 → 2.0 → 3.0 → Green) with a Rust-language rewrite (LockBit-NG-Dev) recovered during Operation Cronos but never field-deployed. LockBit 2.0 introduced the StealBit custom data-exfiltration utility and automated-affiliate-onboarding tooling that became a defining sector-wide pattern; LockBit 3.0 / Black introduced the leak-site bug-bounty programme (offering up-to-$1M payouts for vulnerability disclosures against the LockBit infrastructure itself) and reused partial source code from the leaked BlackMatter codebase; LockBit Green (January 2023) was a build incorporating Conti v3 source code (publicly leaked during the February-March 2022 ContiLeaks dump) and re-released under LockBit branding to capture Conti-affiliate migration after the Conti operator dissolution.

The encryptor's distinguishing technical features include a configurable speed-versus-stealth tradeoff (LockBit 2.0 marketed itself as the fastest ransomware encryptor on the market, with vendor-corroborated benchmarks against Sodinokibi / REvil and BlackMatter), a dedicated Linux/ESXi variant that helped drive the sector-wide pivot to hypervisor-targeted attacks, and a print-bombing capability that printed the ransom note across all networked printers as a psychological-pressure mechanism. The affiliate-management infrastructure — leak-site portal, affiliate panel, crypto-payment routing, victim-negotiation chat — was operated by Khoroshev with an approximately 20% operator cut of ransom payments per the DOJ indictment; affiliate ransom-payment addresses were generated under operator supervision but custodied by affiliates, producing the wallet-cluster topology that NCA, Chainalysis, and TRM Labs used to identify affiliate continuity across encryptor-version rotations.

The family's role in the OAK-G05 monetization chain is the encryption-and-extortion node: post-intrusion (the off-chain enterprise-IT compromise sits outside OAK on-chain Tactic scope), the LockBit binary executes the file-encryption-and-ransom-note phase, the leak-site portal manages the negotiation, and the resulting Bitcoin (predominantly) ransom payments enter the OAK-T7-Tactic laundering chain that runs through OAK-G03 venues (Garantex, Sinbad pre-takedown, Bitzlato pre-takedown) and onward to off-ramp infrastructure. The on-chain angle that makes LockBit-binary a defender-relevant Software entry rather than purely an enterprise-malware entry is the post-payment laundering tail and the affiliate-wallet-cluster persistence that supports cross-version attribution.

Observed examples

• ICBC U.S. broker-dealer attack (November 9, 2023, ~$9B in disrupted Treasury-securities settlement). The clearest case in the public record of a LockBit-binary deployment producing systemic-risk-class market impact rather than only victim-firm impact; specifically cited in the February 2024 OFAC designation press release ([ofac2024lockbitaffiliates]) as the financial-sector escalation factor that justified the sanctions architecture. Confirmed-grade attribution to LockBit affiliates.
• Boeing (October 2023). LockBit-claimed attack on Boeing's parts-and-distribution business; data leaked on the LockBit leak site after non-payment. Confirmed-grade.
• Royal Mail (January 2023). LockBit Black deployment against Royal Mail International disrupted overseas-mail dispatch for weeks; one of the first U.K.-critical-infrastructure cases that fed the U.K.-government posture leading to Operation Cronos. Confirmed-grade.
• Allen & Overy (November 2023), U.K. Ministry of Defence supplier Zaun (August 2023), and approximately 2,000 other named victims documented in the DOJ Khoroshev indictment victim-roll ([doj2024khoroshev]). Confirmed-grade aggregate.
• OAK on-chain example surface. No OAK examples/ entry exists for LockBit-binary specifically as of v0.1; the OAK angle is the OAK-G05-cluster ransom-payment laundering tail rather than per-binary-deployment incidents. Honest framing: LockBit-binary is enterprise-IT-targeting; it earns its OAK Software entry on the strength of the laundering-tail Techniques (T7.001 / T7.002 / T7.003) and the OAK-G05 operator attribution, not on a per-incident on-chain example record.

Detection / attribution signals

Defenders should treat LockBit-binary detection as a host-layer + on-chain-layer joint problem because the family's load-bearing OAK-relevance is the post-encryption ransom-payment chain rather than the encryption event itself:

• Host-layer process-tree fingerprints — LockBit affiliates frequently deploy via PsExec, Cobalt Strike, or the operator's bundled deployment scripts; characteristic file-extension changes (.abcd in 1.0, .lockbit in 2.0, randomised nine-character extensions in 3.0/Black); ransom-note filenames following the per-version conventions documented in CISA AA23-165A, ACSC, NCSC-UK, and FBI joint advisories.
• Encryptor-side behaviour — service-stop sequences targeting backup, EDR, and database services prior to encryption; shadow-copy deletion via vssadmin / wmic; print-bombing via raw-printer-protocol calls; the LockBit 2.0+ self-spreading SMB-share enumeration.
• Network-layer telemetry — StealBit data-exfiltration to operator-controlled infrastructure (StealBit-specific TLS fingerprint and beacon cadence are documented in vendor reporting from Sophos, Trend Micro, and Mandiant); leak-site negotiation-portal access patterns.
• On-chain-layer signatures (the OAK-relevant signal) — affiliate-controlled ransom-payment wallets exhibit common-funder cluster reuse (OAK-T8.001) across encryptor-version rotations; the ten OFAC-listed cryptocurrency addresses from the February 2024 affiliate designation ([ofac2024lockbitaffiliates]) and the additional Khoroshev-attributable addresses from the May 2024 designation ([ofac2024khoroshev], [chainalysis2024khoroshev]) anchor the SDN-screening surface; downstream routing through Garantex (OAK-G03), Sinbad pre-takedown, and Bitzlato pre-takedown is the dominant 2022–2024 pattern.
• CTI vendor coverage — Sophos (sustained "State of Ransomware" reporting and per-incident write-ups), Trend Micro (continuous LockBit version-by-version analysis), Mandiant (UNC2165 / Evil Corp pivot to LockBit affiliate, plus broader LockBit ecosystem tracking), Microsoft Threat Intelligence (Storm-0506 / Storm-0237 LockBit-affiliate clusters), Unit 42 ([unit42lockbit2023]), Chainalysis and TRM Labs (on-chain affiliate-cluster tracking).

Note: omit specific file hashes from this entry. Defenders should consume current IOCs from CISA AA23-165A (LockBit 3.0 advisory) and live CTI-vendor feeds named above; specific encryptor build hashes change per affiliate-build and are best obtained from threat-intel platforms rather than transcribed.

Citations

• [nca2024operationcronos] — U.K. NCA announcement of Operation Cronos and the LockBit infrastructure seizure, February 20, 2024.
• [ofac2024lockbitaffiliates] — Treasury press release JY2114, February 20, 2024, designating Sungatov and Kondratyev with ten cryptocurrency-address SDN identifiers.
• [doj2024khoroshev] — DOJ unsealed 26-count indictment against Dmitry Yuryevich Khoroshev, May 7, 2024.
• [ofac2024khoroshev] — Treasury press release JY2326, May 7, 2024, designating Khoroshev as the LockBit senior leader.
• [chainalysis2024lockbit] — Chainalysis forensic write-up of the February 2024 LockBit takedown and SDN-address analysis.
• [chainalysis2024khoroshev] — Chainalysis forensic write-up of the Khoroshev designation and downstream Garantex / Sinbad / Bitzlato flows.
• [chainalysis2025ransomware] — Chainalysis 2024-recap ransomware report documenting the post-Cronos LockBit volume collapse.
• [mandiant2022unc2165lockbit] — Mandiant UNC2165-to-LockBit affiliate pivot analysis (Evil Corp brand-rotation context).
• [doj2024ryzhenkov] — DOJ indictment of Aleksandr Ryzhenkov as an Evil Corp-affiliated LockBit affiliate.
• [unit42lockbit2023] — Unit 42 LockBit 3.0 / Black technical analysis. (NEW citation — see summary.)
• [cisaaa23165a] — CISA / FBI joint advisory AA23-165A on LockBit 3.0. (NEW citation — see summary.)
• [sophos2024lockbit] — Sophos sustained LockBit tracking and post-Cronos analysis. (NEW citation — see summary.)
• [trendmicro2024lockbit] — Trend Micro LockBit version-by-version analysis. (NEW citation — see summary.)

Discussion

On lineage and version rotation. LockBit's version line — 1.0 (Jan 2020, .abcd) → 2.0 / Red (Jun 2021, StealBit + automated affiliate panel) → 3.0 / Black (Jun 2022, leaked-BlackMatter code reuse + bug-bounty leak-site) → Green (Jan 2023, leaked-Conti-v3 code reuse) → NG-Dev (2024 Rust rewrite, recovered pre-deployment by Operation Cronos) — is the canonical worked example of encryptor-codebase rotation as continuity-disruption tooling. Each version rotation served the dual purpose of refreshing detection-evasion and capturing affiliate migration from disrupted competitor brands (BlackMatter post-DarkSide, Conti post-ContiLeaks). The Green-branch's incorporation of leaked Conti source code is the cleanest documented case of code reuse across RaaS brands as a market-share-capture tactic and is the principal lineage link between LockBit (OAK-S23) and Conti (OAK-S26).

On predecessors and successors. No single direct ancestor — LockBit 1.0 was developed independently by Khoroshev rather than as a fork of an earlier brand — but partial code-reuse relationships exist with BlackMatter (3.0 / Black) and Conti (Green). On the successor side, the post-Cronos LockBit-affiliate diaspora is one of the inputs to the broader 2024–2025 ransomware-brand-fragmentation pattern (RansomHub, Akira, Cl0p capacity expansion, plus the persistent Conti-successor tier of Black Basta / Royal-renamed-BlackSuit / Karakurt). Mapping affiliate continuity across these post-LockBit rebrands is the active CTI-frontier problem in the sector.

On market-share evolution. LockBit was the dominant RaaS strain by attributable-victim-count and by leak-site-postings 2021–2023; Chainalysis and Coveware tracking placed LockBit at roughly 25–30% of all ransomware payments in 2023. Per [chainalysis2025ransomware], the H2 2024 brand-attributable volume collapsed approximately 79% versus H1, and LockBit's market-share lead was lost to a fragmented post-Cronos field by mid-2025. The collapse is structural-rather-than-cyclical to the extent that the operator-and-affiliate-cluster's name recognition was the load-bearing asset (the OFAC SDN architecture deliberately attacked precisely that asset); whether LockBit-branded extortion recovers is the open empirical question for v0.x.

On takedown / disruption history. Operation Cronos (Feb 2024) was an 11-jurisdiction NCA-led action: 34 servers seized, leak-site domain seized and replaced with NCA-branded content, approximately 7,000 decryption keys recovered and offered to victims, approximately 200 cryptocurrency accounts frozen, 14,000 affiliate-rogue accounts closed. The May 2024 Khoroshev-naming and SDN designation completed the operator-side attribution architecture. The 2025 Aeza Group hosting-provider designation ([ofac2025aeza]) sustained the post-Cronos enforcement tempo at the enabling-infrastructure layer. As of v0.1, LockBit-branded posts on rebuilt mirror leak-sites had resumed at substantially reduced cadence; the brand was not extinct but was structurally degraded, and the operator-cluster's principal asset (Khoroshev's identity-and-jurisdiction protection) was depleted.

On the OAK Software-vs-Group split. OAK-S23 (this entry) is the LockBit encryptor codebase — the software artifact licensed by Khoroshev to affiliates. OAK-G05 is the LockBit operator-and-affiliate cluster — the criminal organisation around Khoroshev plus the named-affiliate cohort (Sungatov, Kondratyev, Vasiliev, Astamirov, Matveev / Wazawaka, Bassterlord, Ryzhenkov). The split mirrors the external cyber-threat-intel taxonomy intrusion-set-vs-malware separation: the encryptor can be operated by multiple affiliate cohorts (Evil Corp / UNC2165 famously rotated onto LockBit affiliates in 2022), and the operator-cluster has rotated through multiple encryptor versions; identifying OAK-S23 with OAK-G05 one-to-one would mis-frame both the cross-affiliate-strain reuse and the operator-codebase-rotation patterns that define how RaaS works structurally.