H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[StealBit](https://attack.mitre.org/software/S1200) is a data exfiltration tool that is developed and maintained by the operators of the the LockBit Ransomware-as-a-Service (RaaS) and offered to affiliates to exfiltrate data from compromised systems for double extortion purposes.(Citation: Cybereason StealBit Exfiltration Tool)(Citation: FBI Lockbit 2.0 FEB 2022)

Labels

malware

15 recorded

Relationships

uses

to Data from Local System

Technique

uses

to Data Transfer Size Limits

Technique

uses

to Debugger Evasion

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Disable or Modify Tools

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Execution Guardrails

Technique

uses

to File and Directory Discovery

Technique

uses

to File Deletion

Technique

uses

to Inter-Process Communication

Technique

uses

Technique

uses

to Non-Application Layer Protocol

Technique

uses

to System Information Discovery

Technique

uses

to System Language Discovery

Technique

uses

to Web Protocols

Technique

3 external

References

mitre-attack

S1200

Cybereason StealBit Exfiltration Tool

https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

FBI Lockbit 2.0 FEB 2022

https://www.ic3.gov/CSA/2022/220204.pdf