Threat intelligence / Malware

LockBit 3.0

[LockBit 3.0](https://attack.mitre.org/software/S1202) is an evolution of the LockBit Ransomware-as-a-Service (RaaS) offering with similarities to BlackMatter and [BlackCat](https://attack.mitre.org/software/S1068) ransomware. [LockBit 3.0](https://attack.mitre.org/software/S1202) has been in use since at least June 2022 and features enhanced defense evasion and exfiltration tactics, robust encryption methods for Windows and VMware ESXi systems, and a more refined RaaS structure over its predecessors such as [LockBit 2.0](https://attack.mitre.org/software/S1199).(Citation: Sentinel Labs LockBit 3.0 JUL 2022)(Citation: Joint Cybersecurity Advisory LockBit JUN 2023)(Citation: Joint Cybersecurity Advisory LockBit 3.0 MAR 2023)(Citation: INCIBE-CERT LockBit MAR 2024)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[LockBit 3.0](https://attack.mitre.org/software/S1202) is an evolution of the LockBit Ransomware-as-a-Service (RaaS) offering with similarities to BlackMatter and [BlackCat](https://attack.mitre.org/software/S1068) ransomware. [LockBit 3.0](https://attack.mitre.org/software/S1202) has been in use since at least June 2022 and features enhanced defense evasion and exfiltration tactics, robust encryption methods for Windows and VMware ESXi systems, and a more refined RaaS structure over its predecessors such as [LockBit 2.0](https://attack.mitre.org/software/S1199).(Citation: Sentinel Labs LockBit 3.0 JUL 2022)(Citation: Joint Cybersecurity Advisory LockBit JUN 2023)(Citation: Joint Cybersecurity Advisory LockBit 3.0 MAR 2023)(Citation: INCIBE-CERT LockBit MAR 2024)

Labels

malware

34 recorded

Relationships

uses

to Bypass User Account Control

Technique

uses

to Clear Windows Event Logs

Technique

uses

Technique

uses

to Data Encrypted for Impact

Technique

uses

to Debugger Evasion

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Disable or Modify Tools

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Execution Guardrails

Technique

uses

to File and Directory Discovery

Technique

uses

to File Deletion

Technique

uses

to Group Policy Modification

Technique

uses

to Inhibit System Recovery

Technique

uses

to Local Accounts

Technique

uses

to Local Storage Discovery

Technique

uses

to Modify Registry

Technique

uses

to Mutual Exclusion

Technique

uses

Technique

uses

to Network Share Discovery

Technique

uses

to Peripheral Device Discovery

Technique

uses

Technique

uses

to Process Discovery

Technique

uses

to Safe Mode Boot

Technique

uses

to Service Execution

Technique

uses

to Service Stop

Technique

uses

to SMB/Windows Admin Shares

Technique

uses

to Software Packing

Technique

uses

to Standard Encoding

Technique

uses

to Symmetric Cryptography

Technique

uses

to System Information Discovery

Technique

uses

to System Language Discovery

Technique

uses

to Web Protocols

Technique

uses

to Windows Service

Technique

uses

to Winlogon Helper DLL

Technique

6 external

References

mitre-attack

S1202

LockBit Black

—

Joint Cybersecurity Advisory LockBit JUN 2023

https://www.cisa.gov/sites/default/files/2023-06/aa23-165a_understanding_TA_LockBit_0.pdf

Joint Cybersecurity Advisory LockBit 3.0 MAR 2023

https://www.cisa.gov/sites/default/files/2023-03/aa23-075a-stop-ransomware-lockbit.pdf

INCIBE-CERT LockBit MAR 2024

https://www.incibe.es/en/incibe-cert/blog/lockbit-response-and-recovery-actions

Sentinel Labs LockBit 3.0 JUL 2022

https://www.sentinelone.com/labs/lockbit-3-0-update-unpicking-the-ransomwares-latest-anti-analysis-and-evasion-techniques