What is LockBit Black Ransomware ?

LockBit Black is a ransomware variant operated by the cybercriminal group LockBit.
It became widely known around 2022 and is considered an evolution of earlier LockBit versions such as LockBit 2.0.

LockBit Black is also known for having strong similarities to the BlackMatter ransomware family, both in source code structure and encryption techniques.

How LockBit Black Works

The attack flow generally follows these stages :

1. Initial Access
   Attackers gain access through:
   • Exposed VPN services
   • Weak passwords
   • Public RDP access
   • Phishing emails
   • Exploited vulnerabilities
2. Privilege Escalation
   • Obtaining administrator or domain admin privileges
   • Disabling antivirus and backup systems
3. Lateral Movement
   • Spreading across servers and endpoints
   • Using tools such as PsExec, SMB, and remote services
4. Data Exfiltration
   • Sensitive company data is stolen before encryption
5. File Encryption
   • Files are encrypted in large scale
   • File extensions are changed
   • A ransom note is dropped into the system
6. Double Extortion
   Victims are threatened with:
   • Permanent data loss
   • Public data leaks if ransom is not paid

Common Characteristics of LockBit Black

Typical indicators include :

• Encrypted files with modified extensions
• Presence of ransom notes such as:
  • Restore-My-Files.txt
• Changed desktop wallpaper
• Disabled services including :
  • SQL services
  • Veeam backup
  • Microsoft Exchange
  • Other backup-related services

It often deletes Windows shadow copies using commands like:

vssadmin delete shadows /all /quiet

Encryption Technology

LockBit Black uses modern encryption algorithms such as :

• AES
• Salsa20
• RSA / ECC for key protection

The encryption process is optimized for speed, allowing thousands of files to be encrypted rapidly across enterprise environments.

Typical Targets

The LockBit group commonly targets:

• Large enterprises
• Manufacturing companies
• Hospitals
• Financial institutions
• Government organizations
• Critical infrastructure

They operate using a :

Ransomware-as-a-Service (RaaS) model

Meaning :

• Developers maintain the ransomware platform
• Affiliates conduct attacks
• Ransom payments are shared between them

Why LockBit Black is Dangerous

LockBit is considered highly dangerous because it is known for:

• Extremely fast encryption speed
• High automation capabilities
• Use of newly disclosed vulnerabilities
• Active leak sites
• Large affiliate network worldwide

In some incidents, full domain encryption occurred within only a few hours after initial compromise.

Signs of a LockBit Black Infection

Common Indicators of Compromise (IOCs) :

• Sudden file renaming or encryption
• High CPU and disk activity
• Suspicious PsExec or remote service events
• Unusual RDP logins
• Antivirus services unexpectedly disabled
• Backup failures
• Inaccessible shared folders or network drives

Immediate Response Actions

If LockBit Black infection is suspected :

1. Isolate affected systems immediately
2. Disconnect internet/network access
3. Disable shared folders and SMB access
4. Avoid unnecessary reboots
5. Preserve evidence:
   • Ransom notes
   • Encrypted files
   • Memory/process dumps
6. Investigate possible data exfiltration
7. Contact an incident response team

Prevention Recommendations

Recommended security measures include :

• Enable MFA for VPN and RDP
• Disable public RDP exposure
• Regular patch management
• Network segmentation
• Immutable backups
• Deploy EDR/XDR solutions
• SIEM monitoring
• Least privilege access control
• Remove unused accounts and services