# LockBit

> As of 2026-10-21, LockBit is a Russia-nexus threat actor tracked by Threadlinqs Intelligence across 10 threats spanning ransomware, ransomware hacktivism, threat intel. Also known as ABCD ransomware, Hydra, LockBitSupp, LockBit Gang. ATT&CK coverage spans 134 techniques across 15 tactics in 10 of 10 tracked threats. Most-observed techniques: T1078 (Valid Accounts), T1133 (External Remote Services), T1685 (Disable or Modify Tools).

- **Nation:** Russia
- **Tracked threats:** 10
- **Categories:** RANSOMWARE, RANSOMWARE_HACKTIVISM, THREAT_INTEL, MALWARE
- **Also known as:** ABCD ransomware, Hydra, LockBitSupp, LockBit Gang
- **As of:** 2026-10-21

## ATT&CK techniques observed

134 techniques observed across 10 of 10 tracked threats. Tactics: Discovery (19), Stealth (formerly Defense Evasion) (18), Execution (15), Persistence (13), Resource Development (12), Command and Control (11).

- [T1078](https://intel.threadlinqs.com/technique/T1078) Valid Accounts — Initial Access — observed in 10 of 10 tracked threats
- [T1133](https://intel.threadlinqs.com/technique/T1133) External Remote Services — Initial Access — observed in 9 of 10 tracked threats
- [T1685](https://intel.threadlinqs.com/technique/T1685) Disable or Modify Tools — Defense Impairment — observed in 9 of 10 tracked threats
- [T1486](https://intel.threadlinqs.com/technique/T1486) Data Encrypted for Impact — Impact — observed in 8 of 10 tracked threats
- [T1021](https://intel.threadlinqs.com/technique/T1021) Remote Services — Lateral Movement — observed in 7 of 10 tracked threats
- [T1190](https://intel.threadlinqs.com/technique/T1190) Exploit Public-Facing Application — Initial Access — observed in 7 of 10 tracked threats
- [T1567](https://intel.threadlinqs.com/technique/T1567) Exfiltration Over Web Service — Exfiltration — observed in 7 of 10 tracked threats
- [T1027](https://intel.threadlinqs.com/technique/T1027) Obfuscated Files or Information — Stealth (formerly Defense Evasion) — observed in 6 of 10 tracked threats
- [T1036](https://intel.threadlinqs.com/technique/T1036) Masquerading — Stealth (formerly Defense Evasion) — observed in 6 of 10 tracked threats
- [T1059](https://intel.threadlinqs.com/technique/T1059) Command and Scripting Interpreter — Execution — observed in 6 of 10 tracked threats
- [T1070](https://intel.threadlinqs.com/technique/T1070) Indicator Removal — Stealth (formerly Defense Evasion) — observed in 6 of 10 tracked threats
- [T1490](https://intel.threadlinqs.com/technique/T1490) Inhibit System Recovery — Impact — observed in 6 of 10 tracked threats
- [T1566](https://intel.threadlinqs.com/technique/T1566) Phishing — Initial Access — observed in 6 of 10 tracked threats
- [T1003](https://intel.threadlinqs.com/technique/T1003) OS Credential Dumping — Credential Access — observed in 5 of 10 tracked threats
- [T1005](https://intel.threadlinqs.com/technique/T1005) Data from Local System — Collection — observed in 5 of 10 tracked threats

## Tracked threats

- [Healthcare Sector Ransomware Targeting and Expanding Attack Surface (Qilin, Akira, DragonForce, LockBit, The Gentlemen)](https://intel.threadlinqs.com/threat/TL-2026-3127) — HIGH
- [LockBit 5.0 Ransomware Extortion Claim Against US Bank (U.S. Bancorp)](https://intel.threadlinqs.com/threat/TL-2026-2094) — HIGH
- [France Threat Landscape: Qilin/MedusaLocker/LockBit Ransomware and NoName057(16) Hacktivist DDoS Campaign Amid 4x Dark Web Activity Surge](https://intel.threadlinqs.com/threat/TL-2026-1652) — HIGH
- [Proofpoint AI Era Ransomware Report: 37% of Paying Victims Face Repeat Extortion Demands](https://intel.threadlinqs.com/threat/TL-2026-1710) — MEDIUM
- [Identity Attacks Overtake Exploits as Top Ransomware Cause (Sophos State of Ransomware 2026)](https://intel.threadlinqs.com/threat/TL-2026-1398) — INFO
- [Q1 2026 Ransomware Landscape: Qilin Dominance, LockBit 5.0 Comeback, and FortiGate (CVE-2024-55591) / Oracle EBS (CVE-2025-61882) Mass Exploitation](https://intel.threadlinqs.com/threat/TL-2026-0758) — CRITICAL
- [Human-Operated Ransomware via GPO Abuse — Domain-Wide Encryption Through Group Policy Weaponization](https://intel.threadlinqs.com/threat/TL-2026-0273) — HIGH
- [Ransomware C2 Infrastructure Abuse — Bulletproof Hosting Procurement, VPS Exploitation, Hosting Panel Compromise, Cobalt Strike on Legitimate Infrastructure, Multi-Jurisdictional Takedown Complexity](https://intel.threadlinqs.com/threat/TL-2026-0099) — HIGH
- [LockBit 5.0 Cross-Platform Ransomware Analysis](https://intel.threadlinqs.com/threat/TL-2026-0062) — CRITICAL
- [BYOVD EDR Killer Tooling — Ransomware Groups Weaponizing Signed Kernel Drivers to Blind Endpoint Detection](https://intel.threadlinqs.com/threat/TL-2026-0091) — HIGH

## Related CVEs

28 CVEs referenced by tracked LockBit activity.

- [CVE-2025-61884](https://intel.threadlinqs.com/cve/CVE-2025-61884)
- [CVE-2025-61882](https://intel.threadlinqs.com/cve/CVE-2025-61882)
- [CVE-2025-33073](https://intel.threadlinqs.com/cve/CVE-2025-33073)
- [CVE-2025-32433](https://intel.threadlinqs.com/cve/CVE-2025-32433)
- [CVE-2024-55591](https://intel.threadlinqs.com/cve/CVE-2024-55591)
- [CVE-2024-47575](https://intel.threadlinqs.com/cve/CVE-2024-47575)
- [CVE-2024-40766](https://intel.threadlinqs.com/cve/CVE-2024-40766)
- [CVE-2024-40711](https://intel.threadlinqs.com/cve/CVE-2024-40711)
- [CVE-2024-37085](https://intel.threadlinqs.com/cve/CVE-2024-37085)
- [CVE-2024-1709](https://intel.threadlinqs.com/cve/CVE-2024-1709)
- [CVE-2024-1708](https://intel.threadlinqs.com/cve/CVE-2024-1708)
- [CVE-2023-4967](https://intel.threadlinqs.com/cve/CVE-2023-4967)
- [CVE-2023-4966](https://intel.threadlinqs.com/cve/CVE-2023-4966)
- [CVE-2023-28252](https://intel.threadlinqs.com/cve/CVE-2023-28252)
- [CVE-2023-27532](https://intel.threadlinqs.com/cve/CVE-2023-27532)
- [CVE-2023-27350](https://intel.threadlinqs.com/cve/CVE-2023-27350)
- [CVE-2023-20269](https://intel.threadlinqs.com/cve/CVE-2023-20269)
- [CVE-2023-0669](https://intel.threadlinqs.com/cve/CVE-2023-0669)
- [CVE-2021-44228](https://intel.threadlinqs.com/cve/CVE-2021-44228)
- [CVE-2021-22986](https://intel.threadlinqs.com/cve/CVE-2021-22986)
- [CVE-2020-3580](https://intel.threadlinqs.com/cve/CVE-2020-3580)
- [CVE-2020-3259](https://intel.threadlinqs.com/cve/CVE-2020-3259)
- [CVE-2020-1472](https://intel.threadlinqs.com/cve/CVE-2020-1472)
- [CVE-2020-0796](https://intel.threadlinqs.com/cve/CVE-2020-0796)
- [CVE-2019-0708](https://intel.threadlinqs.com/cve/CVE-2019-0708)
- [CVE-2018-19320](https://intel.threadlinqs.com/cve/CVE-2018-19320)
- [CVE-2018-13379](https://intel.threadlinqs.com/cve/CVE-2018-13379)
- [CVE-2015-2291](https://intel.threadlinqs.com/cve/CVE-2015-2291)

## Full data

Infrastructure, IOC values and detection queries (Splunk SPL / Microsoft KQL / Sigma) require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/actor/LockBit