LockBit 2.0 Ransomware (Bitwise Spider) - Technical Reverse Engineering Analysis

Key facts for LockBit 2.0 ransomware

Detection coverage for LockBit 2.0 ransomware

As of 2026-11-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5284 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: LockBit 2.0 .lockbit File Association and mshta HTA Launcher

TL-2026-5284: LockBit 2.0 creates HKLM\SOFTWARE\Classes\.lockbit and Classes\Lockbit\shell\Open\Command pointing at mshta.exe with LockBit_Ransomware.hta in the user profile. Detects the registry association, the dropped HTA, and mshta launching it.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1546.001, T1218.005, T1112
• Data sources: sysmon, microsoft_defender_for_endpoint, windows_process_creation
• Severity: high
• Confidence: high

Splunk SPL

index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" earliest=-24h ((EventCode=1 Image="*\\mshta.exe" CommandLine="*LockBit_Ransomware.hta*") OR (EventCode IN (12,13,14) TargetObject="*\\Classes\\Lockbit\\shell\\*") OR (EventCode IN (12,13,14) TargetObject="*\\Classes\\.lockbit*") OR (EventCode=11 TargetFilename="*\\LockBit_Ransomware.hta"))
```LockBit 2.0 registers a .lockbit file association whose open command runs mshta.exe against a dropped HTA```
| eval indicator=case(EventCode=1,"mshta_launches_lockbit_hta", EventCode=11,"lockbit_hta_dropped", like(lower(TargetObject),"%lockbit%shell%"),"lockbit_open_command_registered", true(),"lockbit_file_association")
| stats min(_time) as first_seen values(indicator) as indicators values(Image) as images values(CommandLine) as commands values(TargetObject) as registry_keys values(Details) as registry_values values(TargetFilename) as files by host User
| convert ctime(first_seen)
| table first_seen host User indicators images commands registry_keys registry_values files

Microsoft KQL

union
(DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where FileName =~ "mshta.exe" and ProcessCommandLine contains "LockBit_Ransomware.hta"
    | project Timestamp, DeviceName, Account = AccountName, Indicator = "mshta_launches_lockbit_hta", Detail = ProcessCommandLine),
(DeviceRegistryEvents
    | where Timestamp > ago(24h)
    | where RegistryKey contains @"\Classes\Lockbit\shell" or RegistryKey endswith @"\Classes\.lockbit"
    | project Timestamp, DeviceName, Account = InitiatingProcessAccountName, Indicator = "lockbit_file_association", Detail = strcat(RegistryKey, " = ", RegistryValueData)),
(DeviceFileEvents
    | where Timestamp > ago(24h)
    | where FileName =~ "LockBit_Ransomware.hta"
    | project Timestamp, DeviceName, Account = InitiatingProcessAccountName, Indicator = "lockbit_hta_dropped", Detail = FolderPath)
| order by Timestamp desc

Sigma

title: LockBit 2.0 HTA Launched via mshta.exe File Association
id: 7c1e2a94-5d38-4b6f-8a03-2e9f4b7d6c02
status: experimental
description: Detects mshta.exe opening LockBit_Ransomware.hta, the launcher reached through the .lockbit file association that LockBit 2.0 registers for persistence (TL-2026-5284).
references:
    - https://www.chuongdong.com/reverse%20engineering/2022/03/19/LockbitRansomware/
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-165a
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/05
tags:
    - attack.persistence
    - attack.t1546.001
    - attack.defense-evasion
    - attack.t1218.005
    - attack.t1112
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\mshta.exe'
        CommandLine|contains: 'LockBit_Ransomware.hta'
    condition: selection
falsepositives:
    - Unlikely; a legitimate file would not carry this name
level: high

Known false positives:

• Red-team or malware-analysis sandboxes detonating the sample
• Security tooling that replays known ransomware artifacts

Tuning notes: Requires Sysmon registry (12/13/14) and file-create (11) events. Exclude analysis sandboxes by host. The HTA file name is a sample-specific indicator; later builds may rename it, so also review mshta.exe launches from AppData.

• 🔒 LockBit 2.0 UAC Bypass via CMSTPLUA / ColorDataProxy COM Elevation · unlock with TL Creds
• 🔒 LockBit 2.0 GPO-Delivered Windows Defender Disablement · unlock with TL Creds
• 🔒 LockBit 2.0 Subnet Scan for SMB/RPC Shares (Ports 135/445 Fan-Out) · unlock with TL Creds
• 🔒 LockBit 2.0 Self-Deletion (ping 127.0.0.7 and fsutil setZeroData) · unlock with TL Creds
• 🔒 LockBit 2.0 Mass Termination of Database, Backup and Security Processes/Services · unlock with TL Creds
• 🔒 LockBit 2.0 Ransom Note and Encrypted File Artifacts · unlock with TL Creds
• 🔒 LockBit 2.0 Recovery Inhibition and Event Log Clearing (vssadmin/wmic/bcdedit/wevtutil) · unlock with TL Creds
• 🔒 LockBit 2.0 SYSVOL siripts Staging and Forced GPUpdate Propagation · unlock with TL Creds

Indicators of compromise for LockBit 2.0 ransomware

As of 2026-11-05, Threadlinqs Intelligence tracks 15 indicators of compromise for TL-2026-5284.

Sample indicators (2 of 15)

• File hash: 9feed0c7fa8c1d32390e1c168051267df61f11b048ec62aa5b8e66f60e8083af
• File hash: 63dcf75ad743b292e4a6cd067ffc2c18

Defanged, TLP:CLEAR. Full set of 15 indicators: unlock with TL Creds.

How LockBit 2.0 ransomware works

LockBit 2.0 (appeared June 2021, bundled with the StealBit exfiltration tool) is a ransomware-as-a-service payload operated by the LockBit group (CrowdStrike: Bitwise Spider). This record documents the sample analyzed by Chuong Dong (static analysis in IDA Pro, published 2022-03-19; MD5 63dcf75ad743b292e4a6cd067ffc2c18, SHA256 9feed0c7fa8c1d32390e1c168051267df61f11b048ec62aa5b8e66f60e8083af). No CVE or CVSS is associated; the sample abuses built-in Windows functionality and Active Directory design.

Execution and evasion: the sample hides its strings as runtime-decoded stack strings, resolves APIs inline using FNV1A hashes (loading gdiplus, ws2_32, netapi32, activeds, mpr, bcrypt, wtsapi32 and others via LoadLibraryA), and checks PEB NtGlobalFlag for the value 0x70, hanging indefinitely if a debugger is detected. It queries GetSystemDefaultUILanguage/GetUserDefaultUILanguage and skips encryption on hosts using Azerbaijani, Armenian, Belarusian, Georgian, Kazakh, Kyrgyz, Russian, Tajik, Turkmen, Uzbek or Ukrainian locales. It adds an ACCESS_DENIED ACE for Everyone to its own process, enables SeDebugPrivilege and SE_TAKE_OWNERSHIP_PRIVILEGE, and creates a run-once mutant named by a GUID built from the public key bytes. If not already SYSTEM (S-1-5-18) it duplicates a session token (WTSQueryUserToken/DuplicateTokenEx/CreateProcessAsUserW). For UAC bypass it masquerades as explorer.exe by editing its PEB loader entry and abuses the ColorDataProxy and CCMLuaUtil auto-elevating COM interfaces (UACME technique).

Persistence and configuration: a Run key value named with the public-key GUID points at the executable and is removed after encryption. The sample registers a .lockbit file association whose open command launches a dropped LockBit_Ransomware.hta via mshta.exe. An XOR(0x5F)-encoded flag array toggles UAC bypass, self-deletion, logging, network traversal, AD group-policy propagation, the .lockbit icon, and ransom-note printing on network printers.

Impact preparation: the malware kills a list of processes (databases, Office, mail, backup, remote-access and analysis tools such as wireshark, sysmon, procmon, ProcessHacker) and stops SQL Server, Veeam, Acronis, Commvault, VMware and similar services. It runs `vssadmin delete shadows /all /quiet & wmic shadowcopy delete`, sets bcdedit bootstatuspolicy ignoreallfailures and recoveryenabled no, and clears the Security, System and Application event logs with wevtutil.

Encryption: a victim Curve25519 key pair is generated with Libsodium crypto_box_keypair and sealed to the attacker public key; per-file 16-byte AES key and IV are used for AES-128-CBC. Only the first 4KB of most files is encrypted; database/archive extensions (.sql, .mdf, .zip, .7z and others) receive multiple 1MB chunks. Files are renamed with the .lockbit extension, Restore-My-Files.txt is dropped in each directory, a wallpaper bitmap is set, and notes are printed to physical printers. Work is spread across threads (one per CPU core) via an I/O completion port, with a per-drive %02X%02X%02X%02X.lock file preventing duplicate work.

Propagation: if the host is a domain controller and the token has domain admin rights, the sample copies itself to %SystemRoot%\SYSVOL_DFSR\sysvol\<domain>\siripts and builds a GPO (IGroupPolicyObject CLSID {EA502722-A23D-11D1-A7D3-0000F87571E3}) containing NetworkShares.xml, Services.xml, Files.xml (copies the binary to the desktop of every host), ScheduledTasks.xml (taskkill /F of target processes) and Registry.pol (disables Windows Defender real-time monitoring and sets threat actions to ignore). It forces application with a PowerShell Get-ADComputer | Invoke-GPUpdate loop, falling back to a scheduled task that reboots hosts with shutdown.exe /r /f /t 0. Independently, it scans the local subnet on ports 135 and 445, enumerates shares with NetShareEnum, and impersonates elevated tokens or the shell process to encrypt remote drives. On completion it overwrites itself with `fsutil file setZeroData` after a ping delay and schedules deletion with MoveFileExW.

Context: CISA/FBI advisory AA23-165A describes LockBit as the most globally active ransomware variant in 2022 and 2023. LockBit 3.0 (LockBit Black) followed in June 2022 as a continuation of 2.0. The NCA-led Operation Cronos disrupted the group's infrastructure on 2024-02-19, and in May 2024 the administrator LockBitSupp was identified as Russian national Dmitry Khoroshev and sanctioned by the US, UK and Australia. The source analysis lists no network IOCs (IPs/domains), so BeaconBeagle C2 correlation was not applicable to this sample.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1070.004 File Deletion; T1218.005 Mshta; T1622 Debugger Evasion

Discovery

T1046 Network Service Discovery; T1135 Network Share Discovery; T1614.001 System Language Discovery

Persistence

T1053.005 Scheduled Task; T1546.001 Change Default File Association; T1547.001 Registry Run Keys / Startup Folder

Execution

T1059.001 PowerShell; T1106 Native API

defense-impairment

T1112 Modify Registry; T1484.001 Group Policy Modification; T1685 Disable or Modify Tools; T1685.005 Clear Windows Event Logs

Privilege Escalation

T1134.001 Token Impersonation/Theft; T1548.002 Bypass User Account Control

Impact

T1489 Service Stop; T1490 Inhibit System Recovery; T1529 System Shutdown/Reboot

Lateral Movement

T1570 Lateral Tool Transfer

Remediation for LockBit 2.0 ransomware

Immediate actions

• Hunt for Restore-My-Files.txt, .lockbit files and LockBit_Ransomware.hta on endpoints and file servers
• Alert on vssadmin delete shadows, wmic shadowcopy delete, bcdedit recoveryenabled no and wevtutil cl executions
• Audit SYSVOL (including SYSVOL_DFSR\sysvol\<domain>\siripts) for unexpected executables and newly created GPOs with Files.xml, ScheduledTasks.xml and Services.xml
• Isolate hosts showing mshta.exe launched via the Lockbit file association

Workarounds

• Set UAC to Always Notify and remove local admin rights from standard users to hinder COM-based UAC bypass
• Block mshta.exe execution where not required

Longer-term hardening

• Maintain offline, immutable backups and test restores
• Restrict Domain Admin use and tier administrative accounts to limit GPO creation rights
• Enable tamper protection for Windows Defender and alert on Defender policy changes via GPO
• Segment SMB (445) and RPC (135) between workstation networks and servers
• Forward event logs off-host so wevtutil log clearing does not destroy evidence

Affected and fixed versions

• Microsoft — Windows (32-bit sample; Active Directory domains with SYSVOL/GPO)
  Vulnerable versions: Windows endpoints and servers without hardened UAC/GPO controls

Timeline of LockBit 2.0 ransomware

• 2019-09-01 LockBit ransomware created and administered by LockBitSupp since approximately September 2019 (law-enforcement attribution reported 2024).
• 2021-06-01 locked-ioc-12 appears, bundling the locked-ioc-14 information-stealing tool for data exfiltration.
• 2022-03-19 Chuong Dong publishes a static reverse engineering analysis of the locked-ioc-12 sample (SHA256 9feed0c7...083af).
• 2022-06-01 LockBit 3.0 (LockBit Black) launched as a continuation of locked-ioc-12; locked-ioc-14 continues to be used by affiliates.
• 2023-03-16 FBI, CISA and MS-ISAC publish advisory AA23-075A on LockBit 3.0 ransomware.
• 2023-06-14 CISA, FBI, MS-ISAC and international partners publish AA23-165A naming LockBit the most globally active ransomware in 2022 and 2023.
• 2024-02-19 NCA-led Operation Cronos takes over LockBit infrastructure and its dark-web leak site, with arrests and indictments in Poland, Ukraine and Russia; affiliate count falls from 194 to 69.
• 2024-05-07 LockBitSupp identified as Russian national Dmitry Khoroshev; US charges unsealed and sanctions imposed by the US, UK and Australia with a $10M US reward.

Sources cited for LockBit 2.0 ransomware

• CISA AA23-165A Understanding Ransomware Threat Actors: LockBit CISA · Government advisory · 2023-06-14
• CISA AA23-075A LockBit 3.0 Ransomware (FBI/CISA/MS-ISAC) ic3.gov · Advisory · 2023-03-16
• NCSC: International partners LockBit ransomware threat NCSC (UK) · Advisory · 2023-06-14
• LockBit Ransomware v2.0 - Chuong Dong chuongdong.com · Research · 2022-03-19
• Searchlight Cyber: A timeline of events - Operation Cronos and LockBit slcyber.io · Research · 2024-02-19
• Picus Security: CISA Alert AA23-075A - The Latest LockBit Ransomware Variant, LockBit 3.0 picussecurity.com · Blog · 2023-03-16
• NCA: Operation Cronos LockBit disruption nca-newsroom.prgloo.com · News · 2024-02-19
• Help Net Security: LockBit leader unmasked, US charges Russian national Help Net Security · News · 2024-05-07
• BleepingComputer: LockBit ransomware admin identified, sanctioned in US, UK, Australia BleepingComputer · News · 2024-05-07

More in ransomware

• Halcyon August 2026 Ransomware Report: 10 of Top 15 Families New vs. July; Manufacturing Top Target
• Dark Project Ransomware Gang Claims 38 Victims Across 8 Countries, Targeting Healthcare and Manufacturing
• BlackNevas and The Gentlemen Ransomware Cases Against ESXi and Proxmox Virtualization Environments
• HYFLOCK Ransomware-as-a-Service: Partial (First 4KB) Encryption of Larger Files
• Vexy Ransomware claims ZipAI (Vietnam, Technology) - 15.73 GB exfiltrated

Related coverage of this activity

• LockBit 4.0 Green

More from LockBit

• Top 10 Critical Threat Actors to Watch in 2026: Akira, DragonForce, Qilin, LockBit, Scattered Spider, Cl0p, Lazarus, Volt Typhoon, APT29, OilRig (CVE-2024-40766, CVE-2025-61882, CVE-2023-34362, CVE-2024-39717, CVE-2024-30088)
• France Cyber Threat Outlook: Dark Web Credential Trade, Ransomware (Qilin/MedusaLocker/LockBit) and NoName057(16) Hacktivism
• Healthcare Sector Ransomware Targeting and Expanding Attack Surface (Qilin, Akira, DragonForce, LockBit, The Gentlemen)
• LockBit 5.0 Ransomware Extortion Claim Against US Bank (U.S. Bancorp)
• France Threat Landscape: Qilin/MedusaLocker/LockBit Ransomware and NoName057(16) Hacktivist DDoS Campaign Amid 4x Dark Web Activity Surge
• Proofpoint AI Era Ransomware Report: 37% of Paying Victims Face Repeat Extortion Demands

Previous and next in ransomware

• PLAY Ransomware (PlayCrypt) - Reverse Engineering Analysis and Big Game Hunting Operations Previous report
• Rook Ransomware (.Rook) - Babuk-derived ransomware with AES-128/RSA-2048 encryption linked to BRONZE STARLIGHT Next report