La Trobe University research: network-based detection of SMB shared-storage ransomware encryption — Threadlinqs Intelligence
As of 2026-07-05, La Trobe University research: network-based detection of SMB shared-storage ransomware encryption is a info-severity threat intel threat attributed to LockBit — referenced only as the illustrative test sample in the cited detection research (Russia (affiliate nationals per 2024 DOJ/Operation Cronos indictments; LockBit is a financially motivated criminal RaaS operation, not confirmed state-sponsored)), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 24 indicators of compromise.
Threat ID: TL-2026-1121 · Severity: INFO · Status: MONITORING · Category: THREAT_INTEL
Attribution: LockBit — referenced only as the illustrative test sample in the cited detection research · Russia (affiliate nationals per 2024 DOJ/Operation Cronos indictments; LockBit is a financially motivated criminal RaaS operation, not confirmed state-sponsored) · FINANCIAL
Academic researchers at La Trobe University (Melbourne, Australia) published a network-wire detection framework — SMBv2 packet-size 'Region of Interest' signatures feeding a three-stage classifier
La Trobe University researchers developed a network-wire detection framework for ransomware that bulk-encrypts files on SMB-based shared network storage. The method does not inspect file contents; it fingerprints SMB control-plane behavior. It first identifies a 'Region of Interest' by tracking directory/file-enumeration packets that hold a consistent size (~260 bytes on SMBv2), then examines control packets that stay a fixed size for specific SMB operations (e.g., ~410 bytes for new-file-creation responses); everything between two boundary packets becomes one unit of activity, removing bias introduced by fixed time-window analysis. Classification runs in three stages: (1) comparison against known indicators of compromise, (2) ransom-note size fingerprinting (each ransomware family tends to produce a recognizable note size), and (3) a Random Committee ensemble machine-learning classifier trained on the resulting packet-size feature set. Reported performance was ~99.6% accuracy on the researchers' test dataset with zero false negatives and a low false-positive rate; an early-detection variant tuned to trigger on minimal observed activity reported ~99.44% accuracy. Testing used a single-client/single-server testbed, and to stress benign-vs-malicious discrimination the researchers generated legitimate-but-attack-like traffic using Hicrypt, TeraCopy bulk file-copy operations, and WinRAR/7-Zip with encryption enabled, alongside real ransomware samples. LockBit was one of the ransomware samples used in testing and became identifiable by the framework after roughly one-third of its encryption run; encrypted SMBv3 traffic was evaluated as a separate dataset not detailed in the primary write-up, and the paper does not address production-network scalability beyond the single-testbed setup. The preprint is hosted at arxiv.org/abs/2606.30586.
This is a defensive detection-methodology publication, not an active-threat report: it discloses no CVE, no CVSS-scored vulnerability, no exploited flaw, no new ransomware variant or campaign, no C2 infrastructure, and no malware sample/hash of its own. It was surfaced by the HUNT phase and explicitly marked SKIP ('Does not meet HUNT threat-selection criteria: no CVE, no CVSS, no confirmed active exploitation, no public exploit PoC, no CISA KEV listing, no nation-state attribution/new TTPs, no supply-chain compromise, and no new ransomware variant or campaign'); independent WebFetch verification of the Help Net Security article confirms that determination.
Because the source article names LockBit specifically as its illustrative ransomware sample, this record documents LockBit's independently sourced background as threat-intelligence context for defenders evaluating the detection approach. LockBit was first observed in September 2019 operating under the '.abcd' file extension (tracked by some vendors as ABCD Ransomware), rebranded to LockBit and adopted a Ransomware-as-a-Service affiliate model in 2020, released LockBit 2.0 in July 2021 (adding Active Directory group-policy abuse to auto-encrypt Windows domains), and released LockBit 3.0 / LockBit Black in June 2022 (adding anti-analysis techniques, password-gated execution, and a ransomware bug-bounty program). CrowdStrike tracks the operator as BITWISE SPIDER; other vendors use the aliases Syrphid and Water Selkie. Per CISA/FBI/MS-ISAC joint advisory AA23-165A (2023-06-14), LockBit was the most active global ransomware/RaaS operation by claimed-victim count in 2022, with affiliates attacking organizations across financial services, food and agriculture, education, energy, government/emergency services, healthcare, manufacturing, and transportation sectors since January 2020. CISA/FBI advisory AA23-075A (2023-03-16, 'StopRansomware: LockBit 3.0') documents affiliate tooling and MITRE ATT&CK-mapped TTPs including Cobalt Strike beacons, SoftPerfect Network Scanner, ProDump-based LSASS credential dumping, PuTTY Link (Plink) tunneling, rclone/MEGA/Fil
Target sectors: government administration, finance, health, manufacturing, education, energy, transport, foodandagriculture
Target regions: North America, Europe, australia, Global
Detections & IOCs
As of 2026-07-27, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 24 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
THREAT_INTEL, INFO, threat intelligence, cybersecurity, T1078, T1133, T1189, T1566, T1190, T1072, T1547, T1547, T1027, T1070.004