Threadlinqs IntelligenceStart free

Threat actorRussiaTracked since 2026-02

LockBit

Also known as:ABCD ransomwareHydraLockBitSuppLockBit Gang

As of 2026-10-09, LockBit is a Russia-nexus threat actor tracked by Threadlinqs Intelligence across 10 threats spanning ransomware, ransomware hacktivism, threat intel. Also known as ABCD ransomware, Hydra, LockBitSupp, LockBit Gang. ATT&CK coverage spans 133 techniques across 15 tactics in 10 of 10 tracked threats. Most-observed techniques: T1078 (Valid Accounts), T1685 (Disable or Modify Tools), T1133 (External Remote Services).

Tracked threats
102 critical · 6 high · 1 medium
First seen
2026-02-04
Last seen
2026-10-09
ATT&CK techniques
133across 10 of 10 threats
Related CVEs
27Referenced by its activity
Attribution
RussiaNation or origin
Nation: Russia · 10 tracked threat(s) · Categories: RANSOMWARE, RANSOMWARE_HACKTIVISM, THREAT_INTEL, MALWARE

Activity timeline

LockBit appears in 10 tracked threats between and ; the busiest month was 2026-02 with 3 reports.

ATT&CK techniques observed

133 techniques observed across 10 of 10 tracked threats · Discovery (19), Stealth (formerly Defense Evasion) (17), Execution (15), Persistence (13), Resource Development (12), Command and Control (11)
  • T1078 Valid Accounts — Initial Accessobserved in 9 of 10 tracked threats
  • T1685 Disable or Modify Tools — Defense Impairmentobserved in 9 of 10 tracked threats
  • T1133 External Remote Services — Initial Accessobserved in 8 of 10 tracked threats
  • T1486 Data Encrypted for Impact — Impactobserved in 8 of 10 tracked threats
  • T1021 Remote Services — Lateral Movementobserved in 7 of 10 tracked threats
  • T1190 Exploit Public-Facing Application — Initial Accessobserved in 7 of 10 tracked threats
  • T1567 Exfiltration Over Web Service — Exfiltrationobserved in 7 of 10 tracked threats
  • T1027 Obfuscated Files or Information — Stealth (formerly Defense Evasion)observed in 6 of 10 tracked threats
  • T1036 Masquerading — Stealth (formerly Defense Evasion)observed in 6 of 10 tracked threats
  • T1059 Command and Scripting Interpreter — Executionobserved in 6 of 10 tracked threats
  • T1070 Indicator Removal — Stealth (formerly Defense Evasion)observed in 6 of 10 tracked threats
  • T1490 Inhibit System Recovery — Impactobserved in 6 of 10 tracked threats
  • T1566 Phishing — Initial Accessobserved in 6 of 10 tracked threats
  • T1003 OS Credential Dumping — Credential Accessobserved in 5 of 10 tracked threats
  • T1005 Data from Local System — Collectionobserved in 5 of 10 tracked threats

Tracked threats

Related CVEs

27 CVEs referenced by tracked LockBit activity