LockBit is (or was) the most active and profitable ransomware-as-a-service (RaaS) operation in recent years. The group provides the LockBit ransomware builder, leak site, negotiation platform, and infrastructure to “affiliates”, independent cybercriminals who do the actual infections, extortion, and payments. In return, affiliates keep 70–80% of ransoms, while LockBit operators take the rest.
When people talk about “LockBit affiliates attacks,” they’re referring to the hundreds of real-world ransomware incidents carried out by these affiliates using LockBit’s tools and brand, not necessarily actions by the core LockBit developers themselves.
LockBit Affiliate Methods During 2023 to 2026:
1. Obtaining initial entry:
a) Gaining initial entry through public services with known vulnerabilities (e.g. VPN, RDP, MOVEit, GoAnywhere, Fortinet, Citrix)
b) Purchasing or stealing from infostealers (e.g. Redline, Lumma, Raccoon) through brute force means to obtain credential information
c) Phishing via email by either sending malware-laden attachments or linking to sites with malware.
d) There are very few instances of exploiting vulnerabilities via drive-by attacks or watering holes.
2. Actions After Successful Exploitation and Lateral Movement
a) Many legitimate tools (LOLBins) that are commonly utilized in conjunction with lateral movement include PowerShell, WMI, PsExec, rundll32, certutil, bitsadmin, etc.
b) Dumping credentials from Mimikatz to have access to LSASS secrets dump file.
c) Using "living-off-the-land" techniques to mask their actions as part of the normal operations and remain undetected.
d) To prevent detection, the Windows Defender and endpoint detection and response (EDR) agents, backup and volume shadow copies were disabled.
3. Deploying & Encrypting
a) Each affiliate customizes their LockBit payload using the dark-web builder (custom ransom note text, wallpaper, etc.).
b) Deployment of payloads via Group Policy or scheduled tasks or directly executing.
c) Encrypting data by appending .lockbit or customized file extensions and dropping a ransom note on each infected file.
4. Extorting and Leaking:
a) Using double and triple extortion; first encrypting files, second stealing data, third threatening to publish that data on a leak website.
b) Posting victim's information (lockbitapt2.onion or mirrors) on affiliate dark web blogs.
c) Using TOX Chat or a Tor site for negotiation purposes. Many affiliates also do their own side negotiations.
LockBit Status in 2026
1. LockBit 3.0, also referred to as LockBit Black, remains operational despite many efforts by police forces globally to stop it (e.g., operation Cronos, Feb 2024, where the FBI, UK NCA and Europol seized LockBit's server infrastructure, arrested its affiliates, and publicly released the source code for LockBit's builder).
a) LockBit announced its "return" in the middle of 2024 with LockBit 3.0 (actually no new code or product - they just continued using the original product).
b) Some former LockBit affiliates had continued to build their own versions of LockBit® independently and thus had the ability to re-brand them "LockBit® 3.0" while others just used the leaked source code.
c) Many affiliates and copycat affiliates were still actively attacking as LockBit or something similar (using LockBit-like tactics) throughout 2025 and 2026.
2. Many LockBit affiliates will probably remain more dispersed than ever before with many affiliate using LockBit's code under various new names while some moved to RansomHub, BlackCat successor groups or custom-coded offerings.
Impact In The World And Examples
1. High Profile Victims : Airlines Boeing, TSMC Suppliers, Royal Mail, Accenture, Continental Air, ION Trading, Hospitals, Cities
2. Typical Ransom Demands : $1 million up to 50 million+ (facts suggest average is around $5-10 million the last couple of years)
3. Data Leaking : Ransomware affiliates will publish stolen data publicly if ransom is not paid - examples include customer records, financial data, employee PII, intellectual property, etc.
4. Speed : Ransomware attacks from initial access (to the network) until encryption may occur within 48-72 hours in some fast-moving campaigns
Organizations Can Mitigate LockBit Ransomware Risks
1. Actively patch public-facing services (VPNs, File Transfer Protocol, and WEB Applications).
2. Implement MFA (multi-factor authentication) everywhere (particularly for Remote Desktop Protocol (RDP) and VPN).
3. Restrict the use of PowerShell on systems to Constrained Language Mode through Group Policy Object (GPO).
4. Disable all deprecated protocols such as SMBv1 (Server Message Block Version 1) and NTLMv1 (Windows NT LAN Manager Version 1).
5. Segment the network to limit lateral movement across the organization.
6. Back up offline & test restores
7. Enable strong EDR behavioral detection (process ancestry, script block logging)
8. Train employees on phishing & suspicious LinkedIn messages
LockBit affiliates don’t invent new techniques every week , they rely on the same entry points most groups use. The difference is scale and speed. Reducing those common entry vectors (VPN/RDP exposure, weak credentials, unpatched software) cuts risk from LockBit-style attacks dramatically.
