LockBit

LockBit operates using an affiliate-based ransomware-as-a-service (RaaS) model in which core developers maintain the malware, payment infrastructure and data leak sites, while affiliates are responsible for gaining initial access to victim networks and conducting lateral movement and data exfiltration. This division of roles enables scalable operations and has contributed to the group’s high incident volume across multiple sectors. Observed intrusion methods include the use of compromised credentials, exploitation of public-facing services and initial access brokers. In addition to encrypting systems, LockBit attacks commonly involve the exfiltration of sensitive data and deliberate efforts to locate and disable backup systems and shadow copies, increasing the complexity and duration of recovery for affected organizations. According to a joint statement by various government agencies, LockBit was the world's most prolific ransomware in 2022. It was estimated in early 2023 to be responsible for 44% of all ransomware incidents globally. In the United States between January 2020 and May 2023, LockBit was used in approximately 1,700 ransomware attacks, with US$91 million paid in ransom to hackers. Government agencies did not formally attribute the group to any nation-state.