FBI holds 7,000+ LockBit decryption keys
FBI possesses 7,000+ LockBit decryption keys and urges victims of the ransomware group to report via IC3 to recover encrypted data.
Sourcefbi.gov — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
FBI Cyber Division Assistant Director Bryan Vorndran announced at the 2024 Boston Conference on Cyber Security that the Bureau has acquired over 7,000 LockBit decryption keys following international disruption operations against the ransomware group. The FBI is proactively reaching out to known victims and encouraging anyone who suspects they were targeted to submit reports through the Internet Crime Complaint Center's dedicated LockBit victim reporting portal at lockbitvictims.ic3.gov.
LockBit ransomware has been deployed in more than 2,400 cyberattacks globally, with over 1,800 incidents affecting U.S. victims across multiple sectors, resulting in billions of dollars in damages. The ransomware-as-a-service operation has proven to be one of the most prolific threats in recent years.
Recent international law enforcement operations to disrupt LockBit infrastructure and sanction the group revealed that LockBit and its affiliates retained victim data even after ransoms were paid, demonstrating the untrustworthiness of the criminal operators. The FBI's possession of decryption keys provides a critical opportunity for victims to recover their data without paying ransoms.
Mentioned in this report
Detection guidance
Mass Service Stop Preceding Ransomware Encryption (LockBit-style)
A behavioural hunt for the technique in general.
Detects command-line invocation of net.exe/sc.exe/taskkill stopping multiple security, backup, or database services in quick succession, a common LockBit pre-encryption step to unlock files for encryption. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Mass Service Stop Preceding Ransomware Encryption
id: 910e7e5a-ff4d-5b86-a0db-8beb6d4cca2d
status: experimental
description: Detects command-line invocation of service-stop utilities (net.exe, sc.exe,
taskkill) targeting multiple security, backup, or database services in a short period,
consistent with LockBit and similar ransomware disabling protections and unlocking
files prior to encryption.
logsource:
category: process_creation
product: windows
detection:
selection_tools:
Image|endswith:
- \\net.exe
- \\net1.exe
- \\sc.exe
- \\taskkill.exe
selection_action:
CommandLine|contains:
- ' stop '
- /f /im
- config
selection_targets:
CommandLine|contains:
- vss
- sql
- backup
- veeam
- sophos
- mcshield
- defender
- memtas
- sql server
condition: selection_tools and selection_action and selection_targets
falsepositives:
- Legitimate IT administration scripts stopping backup or security services during
maintenance windows
- Software uninstallation processes that stop related services before removal
level: medium
tags:
- attack.t1489
- attack.impact
author: Vorant
Shadow Copy and Backup Deletion Prior to Ransomware Encryption
A behavioural hunt for the technique in general.
Detects use of vssadmin, wmic, or wbadmin to delete shadow copies or disable backup/recovery options, a precursor step used by LockBit and similar ransomware to prevent data recovery before encryption. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Shadow Copy and Backup Deletion Prior to Ransomware Encryption
id: 528355cf-820a-5c8d-87ce-0f07c48e1285
status: experimental
description: Detects command-line deletion of Volume Shadow Copies or Windows backup
catalogs using vssadmin, wmic, or wbadmin, a common precursor to ransomware encryption
such as LockBit to prevent victims from recovering data without paying ransom.
logsource:
category: process_creation
product: windows
detection:
selection_vss:
Image|endswith:
- \\vssadmin.exe
- \\wmic.exe
CommandLine|contains:
- delete shadows
- shadowcopy delete
selection_wbadmin:
Image|endswith: \\wbadmin.exe
CommandLine|contains:
- delete catalog
- delete systemstatebackup
condition: selection_vss or selection_wbadmin
falsepositives:
- Administrators manually clearing old shadow copies to reclaim disk space
- Backup software reconfiguration or catalog maintenance scripts
level: high
tags:
- attack.t1486
- attack.impact
author: Vorant
Mass File Rename with Ransom Extension Indicative of Encryption Activity
A behavioural hunt for the technique in general.
Detects high-volume file rename/write events adding a uniform unusual extension across many files in a short window, consistent with ransomware encryption routines such as LockBit. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Mass File Rename with Ransom Extension Indicative of Encryption
id: 6e933de3-80fc-5352-a6a7-7a0f64e28581
status: experimental
description: Detects file system events where numerous files across user or shared
directories are renamed or written with a new, unrecognized uniform extension in
a short time period, consistent with ransomware mass-encryption behavior such as
that used by LockBit. Threshold/time-window correlation must be enforced by the
SIEM (e.g., more than 50 renames with same new extension within 60 seconds from
a single process).
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|contains:
- .lockbit
- .locked
- .encrypted
- .enc
condition: selection
falsepositives:
- Legitimate file compression, encryption, or archival tools renaming files with similar
extensions
- Backup software creating encrypted archive files with similar naming
level: medium
tags:
- attack.t1486
- attack.impact
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.fbi.gov/news/stories/fbi-cyber-lead-urges-potential-lockbit-victims-to-contact-internet-crime-complaint-center
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the actors and malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs