RANSOMWARE FAMILY
LockBit
LockBit has been one of the most prolific ransomware-as-a-service operations globally, run as an affiliate model where different attackers deploy the same toolkit. International law enforcement action has disrupted parts of its infrastructure, but variants and copycats are still encountered.
What to look for
- File extensions changed to a random string or a LockBit-style suffix on encrypted files
- A ransom note text file dropped in affected folders, often named along the lines of "Restore-My-Files.txt"
- Desktop wallpaper changed to a ransom message on some versions
- A leak-site threat referencing stolen data alongside the encryption
Recovery approach
Recovery options depend heavily on the specific variant and whether shadow copies or backups survived. We assess this as part of every triage before recommending a path forward.
OTHER FAMILIES WE SEE
Also covered
Akira
A newer group known for exploiting VPN and remote-access weaknesses to gain entry.
What to look for →BlackCat / ALPHV
A Rust-based ransomware-as-a-service operation linked to a number of high-profile incidents.
What to look for →Qilin
A ransomware-as-a-service group behind a number of significant UK healthcare and services incidents.
What to look for →RansomHub
A fast-growing ransomware-as-a-service operation that has absorbed affiliates from several disrupted groups.
What to look for →