LockBit 3.0
LockBit, also recognized as LockBit Black or Lockbit 3.0, is one of the largest Ransomware Groups in the world and has orchestrated extensive cyberattacks across various industries, impacting thousands of organizations globally with its relentless and adaptive strategies.
Threat level
CRITICAL
Get an alert if one of your domains is named on a ransomware leak site.
Tactics, Techniques & Procedures (TTPs)
CredentialTheft
- Gosecretsdump
- LaZagne
- LostMyPassword
- Mimikatz
- NirSoft ExtPassword
- +3 more
DefenseEvasion
- Backstab (Process Explorer driver)
- Defender Control
- GMER
- PCHunter
- PowerTool
- +2 more
DiscoveryEnum
- AdFind
- Advanced IP Scanner
- Advanced Port Scanner
- Bloodhound
- Seatbelt
- +1 more
Exfiltration
- Anonfiles
- FileZilla
- File[.]io
- FreeFileSync
- MEGA
- +7 more
LOLBAS
- BCDEdit
- PsExec
Networking
- Ligolo
- Ngrok
- Plink
Offsec
- Cobalt Strike
- Impacket
- Koadic
- Metasploit
- PowerShell Empire
- +1 more
RMM-Tools
- Action1
- AnyDesk
- FixMeIt
- ScreenConnect
- Splashtop
- +2 more
Indicators of Compromise (IOCs)
IP addresses
10- 150.171.30.10
- 20.101.57.9
- 84.201.211.40
- 23.54.127.209
- 64.233.181.94
- 199.232.210.172
- 184.28.89.167
- 20.12.23.50
- 184.30.21.171
- 40.69.42.241
Get the complete IOC feed
The full IOC database by API, ready for your SIEM or SOAR.
Create free accountNo credit card required · Free API key
Known infrastructure
The following Tor hidden services have been associated with this group:
Humanity checkHumanity checkTitleLockBit LOGINHumanity check
These sites are malicious. Open them only from an isolated environment.
Check if you’re affected
Look up your domain to see whether it appears on LockBit 3.0’s victim list.
risk score · threat categories · sources · age · confidence — in one request