LockBit
CriticalRansomware
Also known as: LockBit 3.0, LockBit Black
One of the most prolific ransomware-as-a-service operations, known for fast encryption and double extortion.
What it is
LockBit is a ransomware-as-a-service (RaaS) operation: its operators build the malware and lease it to affiliates who carry out attacks, then split the ransom. It has been one of the most active ransomware families targeting businesses worldwide, including many Australian organisations, and is known for encrypting networks extremely quickly.
How it works
- 1
Affiliates gain an initial foothold, commonly through stolen remote access credentials, unpatched internet-facing systems, or phishing.
- 2
They move laterally across the network and escalate to administrator privileges.
- 3
Data is quietly copied out (exfiltrated) before anything is encrypted.
- 4
LockBit encrypts files across servers and workstations, often outside business hours to delay detection.
- 5
A ransom note demands payment for the decryption key, with a second threat to publish the stolen data on a leak site if the victim refuses (double extortion).
Warning signs
- Antivirus or security tools being disabled or uninstalled unexpectedly
- Unusual administrator logins, especially outside business hours
- Large volumes of data being copied or uploaded to unfamiliar destinations
- Files suddenly renamed with an unfamiliar extension and ransom notes appearing in folders
Business impact
- Complete loss of access to files and systems until recovery
- Extended downtime, often days to weeks, halting operations
- Public leak of sensitive customer, staff and financial data
- Recovery, legal and notification costs that frequently dwarf the ransom itself
How to defend against it
Enforce multi-factor authentication (MFA)
Most ransomware intrusions start with a stolen password. MFA on email, VPN and remote access blocks the vast majority of credential-based entry.
Keep systems patched
Patch internet-facing services and operating systems promptly. LockBit affiliates actively exploit known, unpatched vulnerabilities.
Maintain tested, offline backups
Keep backups offline or immutable so they cannot be encrypted too, and test restores regularly so you know they work.
Restrict administrative privileges
Limit who holds admin rights and separate admin accounts from day-to-day accounts to slow lateral movement.
Measure your defences
Use these free Cyber Toolkit tools to check how exposed you are and close the gaps this threat exploits.
Ready to strengthen your protection?
Book a free security check and we'll show you where your business stands clear next steps, no jargon, no obligation.
If you are unable to reach us by phone, please email and a member of our team will respond promptly.
Or explore our free security tools — 30+ scanners, checkers and assessments, free with an account.