LockBit Ransomware v4.0 (LockBitGreen4.0-rc-577) Reverse Engineering Analysis

Key facts for LockBit 4.0 Green

Detection coverage for LockBit 4.0 Green

As of 2026-11-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5278 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: LockBit 4.0 Ransom Note Restore-My-Files.txt Mass Creation — Encryption Impact

Detects the LockBit 4.0 (LockBitGreen4.0-rc-577) encryptor dropping its ransom note Restore-My-Files.txt into multiple directories within a short window (T1486). The encryptor writes one note per encrypted directory, so three or more distinct note paths from one host in ten minutes is a high-fidelity ransomware execution signal. The search also counts the distinct volume prefixes (drive letters or UNC) receiving notes, since -m all and -m net make the encryptor traverse directories (T1083) across local volumes and network shares (T1135). Note: the -q (quiet) switch suppresses the note, so pair this with the encryptor hash/CLI and shadow-copy detections.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1486, T1083, T1135
• Data sources: sysmon, microsoft_defender_for_endpoint
• Severity: critical
• Confidence: high

Splunk SPL

```LockBit 4.0 (LockBitGreen4.0-rc-577) drops Restore-My-Files.txt in every encrypted directory; alert on 3+ distinct note paths per host in 10 minutes``` index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11 TargetFilename="*Restore-My-Files.txt" earliest=-24h | eval volume=substr(TargetFilename,1,2) | bin _time span=10m | stats dc(TargetFilename) as ransom_notes_written dc(volume) as volumes_touched values(volume) as volumes min(_time) as first_seen max(_time) as last_seen values(Image) as writer_process values(User) as user by host _time | where ransom_notes_written>=3 | eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S") | table host user writer_process ransom_notes_written volumes_touched volumes first_seen last_seen

Microsoft KQL

DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType == "FileCreated" and FileName =~ "Restore-My-Files.txt"
| summarize NotesWritten=dcount(FolderPath), VolumesTouched=dcount(substring(FolderPath, 0, 2)), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by DeviceName, InitiatingProcessFileName, InitiatingProcessSHA256, InitiatingProcessAccountName, Window=bin(Timestamp, 10m)
| where NotesWritten >= 3
| project Window, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessSHA256, NotesWritten, VolumesTouched, FirstSeen, LastSeen

Sigma

title: LockBit 4.0 Ransom Note Restore-My-Files.txt Created
id: 3e8b1f6a-72c4-4a9d-b5e0-0f1c9a4d7e11
status: experimental
description: Detects creation of the LockBit 4.0 (LockBitGreen4.0-rc-577) ransom note Restore-My-Files.txt, dropped into encrypted directories.
references:
    - https://www.chuongdong.com/reverse%20engineering/2025/03/15/Lockbit4Ransomware/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-04
tags:
    - attack.impact
    - attack.t1486
    - attack.discovery
    - attack.t1083
    - attack.t1135
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|endswith: '\Restore-My-Files.txt'
    condition: selection
falsepositives:
    - Backup or restore tooling that legitimately creates a file with the same name (unlikely)
level: critical

Known false positives:

• Incident-response or red-team exercises that replay LockBit ransom-note artifacts in a lab
• Security tooling or sandboxes that detonate samples and generate the note on analysis hosts

Tuning notes: Exclude known malware-analysis sandboxes by host. The threshold of 3 distinct note paths per 10 minutes can be lowered to 2 in high-value server tiers. Sysmon EventCode 11 must be enabled for the file-create rule. The -q switch suppresses the note, so do not rely on this rule alone. Alert on volumes_touched>=2 (or a UNC prefix) to raise priority for -m all / -m net runs.

• 🔒 LockBit 4.0 Encryptor Execution by Hash and Command-Line Switches · unlock with TL Creds
• 🔒 Burst of Services Set to Disabled — LockBit Pre-Encryption Service Stop · unlock with TL Creds
• 🔒 RDP Lateral Movement Fan-Out from a Single Source — LockBit Affiliate Spread · unlock with TL Creds
• 🔒 Volume Shadow Copy and Recovery Inhibition Commands (Conti-Style, LockBit 4.0) · unlock with TL Creds
• 🔒 Windows Event Log Cleared — LockBit 4.0 EvtClearLog Anti-Forensics · unlock with TL Creds
• 🔒 PsExec and Cobalt Strike Remote Service Installation (Lateral Movement) · unlock with TL Creds
• 🔒 LockBit Affiliate Credential Theft and Recon Tooling (Mimikatz, LaZagne, AdFind, Network Scanners) · unlock with TL Creds
• 🔒 LockBit Tor Onion Access and Community-Observed Cobalt Strike C2 Infrastructure · unlock with TL Creds

Indicators of compromise for LockBit 4.0 Green

As of 2026-11-04, Threadlinqs Intelligence tracks 19 indicators of compromise for TL-2026-5278.

Sample indicators (3 of 19)

• Domain: lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id[.]onion
• File hash: c40abd19c60371e1daf19346d88d2881
• Domain: lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id[.]onion

Defanged, TLP:CLEAR. Full set of 19 indicators: unlock with TL Creds.

How LockBit 4.0 Green works

LockBit 4.0 was announced in December 2024 in both Green and Black versions and released in February 2025 by the LockBit ransomware-as-a-service operation. This analysis, published by Chuong Dong on 2025-03-15, covers the Windows encryptor build string 'LockBitGreen4.0-rc-577' (MD5 c40abd19c60371e1daf19346d88d2881, SHA256 4f76df691e2ea292b56812eb3167efcab655382d632048ff63781f5d41f86433). A packed sample has SHA256 67ac04c1b7526288194e53da33cc0e9661687fd4fbbf12156e5ef6dd2a4108eb. Sophos records that LockBit Green was launched in early 2023 using defunct Conti code, and the analysis notes the shadow-copy deletion is 'basically the same as that in Conti'.

Evasion and anti-analysis: Windows APIs are resolved through a custom hashing routine (initial value 0x14BD, case normalization, XOR and position-dependent multiplication), with multi-layer XOR-obfuscated strings. EtwEventWrite() is neutralized by building a 'ret 0x14' patch and writing it over the function entry with ZwProtectVirtualMemory() and ZwWriteProcessMemory(). The sample calls GetKeyboardLayoutList() and aborts if a Russian layout (0x419) is present, printing 'Найдена русская раскладка клавиатуры'. The '-nomutex' argument is accepted but has no effect.

Pre-encryption impact: A hashed allowlist of 120+ process names protects critical processes, and other processes (including file owners) are terminated with ZwTerminateProcess() after an NtQueryInformationProcess() check. 47 hashed service names are stopped with ControlService() and disabled with ChangeServiceConfigA(SERVICE_DISABLED). Volume shadow copies are deleted using Conti-style logic. Every Windows event log channel is enumerated (EvtOpenSession, EvtOpenChannelEnum, EvtNextChannelPath) and cleared with EvtClearLog().

Encryption: Each file gets a Curve25519 key pair, and the shared secret protects an XChaCha20 file key (SHA512 is used in key derivation). Encrypted files get a 0x5C-byte footer containing the marker 'FBIsosite', the encrypted file key, a custom keys hash and the per-file Curve25519 public key. The embedded LockBit public key is f972c17213f928a011870a5ae5b6492e41170c93d2fa61e816a13f9dbf090b02. Files over 1 MB (0x100000) are partially encrypted as three chunks of about 9% each, and smaller files are fully encrypted. The original extension is replaced by a string derived from 'lb4' with a custom XOR routine. Files with exe, lnk, dll, cpl or sys extensions are skipped, as are Restore-My-Files.txt, iconcache.db and thumbs.db, and files under 17 bytes. The RC4-encrypted ransom note Restore-My-Files.txt (RC4 key 0753d87845c8468a6a712586955ff9ba) states 'You have been attacked by LockBit 4.0 - the fastest, most stable and immortal ransomware since 2019'. It carries the access key ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA and lists LockBit onion blog, payment, chat and recruitment addresses. Command-line options are -m local|net|all, -p <path>, -f (force, bypass folder restrictions), -k (keep .exe), -q (quiet: no extension change, timestamps preserved, no note) and -h. After running, the binary renames itself to a random 6-character name via NtSetInformationFile(FileRenameInformation) and marks itself for deletion with FileDispositionInformation.

Affiliate tradecraft documented by Sophos for LockBit operations: initial access via Citrix Bleed and Fortigate firewall exploitation, credential harvesting with Mimikatz and LaZagne, reconnaissance with SoftPerfect Network Scanner, Advanced Port Scanner and ADFind, Cobalt Strike post-exploitation, RDP and PsExec lateral movement, and StealBit for exfiltration. These come from the Sophos profile of LockBit operations in general, not from the analysed sample. The group was disrupted by Operation Cronos (2024-02-19) but resumed operations. Check Point reported in October 2025 that LockBit 5.0 (codename 'ChuongDong') had hit about a dozen victims in September 2025. Active exploitation of this specific build is not stated in the primary source, so the status reflects the ongoing ransomware family.

MITRE ATT&CK techniques by tactic:

Credential Access

T1003 OS Credential Dumping

Lateral Movement

T1021.001 Remote Services: Remote Desktop Protocol

Defense Evasion

T1027 Obfuscated Files or Information; T1027.007 Dynamic API Resolution; T1070.004 Indicator Removal: File Deletion

Discovery

T1057 Process Discovery; T1135 Network Share Discovery; T1614.001 System Location Discovery: System Language Discovery

Execution

T1106 Native API; T1569.002 Service Execution

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1489 Service Stop; T1490 Inhibit System Recovery

defense-impairment

T1685 Disable or Modify Tools; T1685.005 Clear Windows Event Logs

Remediation for LockBit 4.0 Green

Patches

• Apply vendor patches for Citrix Bleed (NetScaler) and Fortinet FortiGate vulnerabilities commonly used by LockBit affiliates

Immediate actions

• Hunt for Restore-My-Files.txt ransom notes and the FBIsosite footer marker on encrypted files
• Alert on bulk Windows event log clearing (Event ID 1102 / 104) and mass volume shadow copy deletion
• Alert on processes writing over ntdll!EtwEventWrite or loading binaries that resolve APIs via hashing
• Block or monitor outbound Tor traffic and the LockBit onion infrastructure
• Isolate hosts showing mass file renames to a randomized extension and a self-renaming, self-deleting executable

Workarounds

• Restrict write access to network shares to reduce '-m net' encryption blast radius
• Enable tamper protection on endpoint security tooling

Longer-term hardening

• Maintain offline, immutable, tested backups
• Deploy EDR with behavioral ransomware and ETW-tamper detection
• Enforce MFA and credential hygiene to limit Mimikatz/LaZagne-style credential theft
• Restrict RDP and PsExec lateral movement through network segmentation
• Review edge-device exposure (Citrix NetScaler, Fortinet FortiGate) and patch promptly

Affected and fixed versions

• Microsoft — Windows
  Vulnerable versions: Windows endpoints and servers (x86/x64 PE encryptor)

Timeline of LockBit 4.0 Green

• 2022-06-01 LockBit 3.0 (Black) released in June 2022, incorporating BlackMatter code and launching a bug bounty program (Sophos).
• 2023-01-01 LockBit Green variant launched in early 2023 using defunct Conti code (Sophos).
• 2024-02-19 UK NCA-led Operation Cronos takes down LockBit infrastructure and seizes the leak site; a new leak site appears on 2024-02-24 (Sophos).
• 2024-05-07 Dmitry Khoroshev indicted and sanctioned as LockBit administrator in May 2024 (Sophos).
• 2024-12-01 LockBit 4.0 announced in December 2024 in both Green and Black versions (Sophos).
• 2025-02-01 LockBit 4.0 officially released in February 2025 (search-result summaries of vendor reporting).
• 2025-03-15 Chuong Dong publishes reverse engineering analysis of build locked-ioc-13.
• 2025-05-02 Joint Technical Advisory on LockBit 3.0 and 4.0 published (2 May 2025).
• 2025-09-01 LockBit officially returns in September 2025; Check Point identifies about a dozen victims, half hit by LockBit 5.0 (codename ChuongDong).
• 2025-10-23 Check Point Research publishes 'LockBit Returns and It Already Has Victims'.

Sources cited for LockBit 4.0 Green

• Joint Technical Advisory on LockBit 3.0 and 4.0 (2 May 2025) isomer-user-content.by.gov.sg · Advisory · 2025-05-02
• LockBit Ransomware v4.0 - Chuong Dong chuongdong.com · Research · 2025-03-15
• Sophos CTU Threat Profile: GOLD MYSTIC Sophos · Vendor report
• Check Point Research: LockBit Returns and It Already Has Victims Check Point · Research · 2025-10-23
• Intel 471 Emerging Threat: LockBit 4.0 (March 2025) go.intel471.com · Research · 2025-03-01
• SOCRadar: Technical Analysis of LockBit 4.0 - Evasion Tales socradar.io · Blog
• LockBit - Wikipedia en.wikipedia.org · News

More in ransomware

• Halcyon August 2026 Ransomware Report: 10 of Top 15 Families New vs. July; Manufacturing Top Target
• Dark Project Ransomware Gang Claims 38 Victims Across 8 Countries, Targeting Healthcare and Manufacturing
• BlackNevas and The Gentlemen Ransomware Cases Against ESXi and Proxmox Virtualization Environments
• HYFLOCK Ransomware-as-a-Service: Partial (First 4KB) Encryption of Larger Files
• Vexy Ransomware claims ZipAI (Vietnam, Technology) - 15.73 GB exfiltrated

Related coverage of this activity

• LockBit 2.0 ransomware

More from LockBit

• Top 10 Critical Threat Actors to Watch in 2026: Akira, DragonForce, Qilin, LockBit, Scattered Spider, Cl0p, Lazarus, Volt Typhoon, APT29, OilRig (CVE-2024-40766, CVE-2025-61882, CVE-2023-34362, CVE-2024-39717, CVE-2024-30088)
• France Cyber Threat Outlook: Dark Web Credential Trade, Ransomware (Qilin/MedusaLocker/LockBit) and NoName057(16) Hacktivism
• Healthcare Sector Ransomware Targeting and Expanding Attack Surface (Qilin, Akira, DragonForce, LockBit, The Gentlemen)
• LockBit 5.0 Ransomware Extortion Claim Against US Bank (U.S. Bancorp)
• France Threat Landscape: Qilin/MedusaLocker/LockBit Ransomware and NoName057(16) Hacktivist DDoS Campaign Amid 4x Dark Web Activity Surge
• Proofpoint AI Era Ransomware Report: 37% of Paying Victims Face Repeat Extortion Demands

Previous and next in ransomware

• Q3 2026 Ransomware Leak-Site Surge: 30% More Victims Driven by 43 New Groups, With Questionable Claims Previous report
• MountLocker Ransomware v5.0 (XingLocker / Astro Locker) - Worm-Capable RSA-2048/ChaCha20 Locker: Reverse Engineering Analysis Next report