LockBit
MITRE G1040Also known as Lockbit5, LockBit5, Lockbit, LockBit 3.0, LockBit, Lockbit 5.0, LockBit 5, LockBit Black, Wizard Spider
Reports
148
First seen
Jan 17, 2024
Last seen
Oct 17, 2026
Motivation
Financial
Relationships
Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.
Targeting
Sectors
Victim regions
×3×17
United States×17
Netherlands×11
Brazil×9
Thailand×6
Germany×5
France×4
Argentina×3
Taiwan×3
Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.
Top ATT&CK techniques
T1486 Data Encrypted for Impact ×8T1566 Phishing ×5T1027 Obfuscated Files or Information ×3T1190 Exploit Public-Facing Application ×3T1562.001 Impair Defenses: Disable or Modify Tools ×2T1489 Service Stop ×2T1070.001 Indicator Removal: Clear Windows Event Logs ×2T1005 Data from Local System ×2T1567 Exfiltration Over Web Service ×2T1105 Ingress Tool Transfer ×2T1059.003 Windows Command Shell ×2T1195 Supply Chain Compromise ×2
Indicators
domain ×175filename ×71ip_v4 ×65hash_sha256 ×24hash_md5 ×12hash_sha1 ×6cve ×5hash_sha512 ×1url ×1
Indicator values are available on Pro and via the API.
Associated CVEs
Recent reports
High