VORANT. Threat Intelligence Sign in Get the full feed

FBI holds 7,000+ LockBit decryption keys

low threat

FBI possesses 7,000+ LockBit decryption keys and urges victims of the ransomware group to report via IC3 to recover encrypted data.

FBI Cyber Division Assistant Director Bryan Vorndran announced at the 2024 Boston Conference on Cyber Security that the Bureau has acquired over 7,000 LockBit decryption keys following international disruption operations against the ransomware group. The FBI is proactively reaching out to known victims and encouraging anyone who suspects they were targeted to submit reports through the Internet Crime Complaint Center's dedicated LockBit victim reporting portal at lockbitvictims.ic3.gov.

LockBit ransomware has been deployed in more than 2,400 cyberattacks globally, with over 1,800 incidents affecting U.S. victims across multiple sectors, resulting in billions of dollars in damages. The ransomware-as-a-service operation has proven to be one of the most prolific threats in recent years.

Recent international law enforcement operations to disrupt LockBit infrastructure and sanction the group revealed that LockBit and its affiliates retained victim data even after ransoms were paid, demonstrating the untrustworthiness of the criminal operators. The FBI's possession of decryption keys provides a critical opportunity for victims to recover their data without paying ransoms.

Mentioned in this report

Threat actors LockBit
Malware LockBit

Detection guidance

Mass Service Stop Preceding Ransomware Encryption (LockBit-style)

ATT&CK T1489

Detects command-line invocation of net.exe/sc.exe/taskkill stopping multiple security, backup, or database services in quick succession, a common LockBit pre-encryption step to unlock files for encryption. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Mass Service Stop Preceding Ransomware Encryption
id: 910e7e5a-ff4d-5b86-a0db-8beb6d4cca2d
status: experimental
description: Detects command-line invocation of service-stop utilities (net.exe, sc.exe,
  taskkill) targeting multiple security, backup, or database services in a short period,
  consistent with LockBit and similar ransomware disabling protections and unlocking
  files prior to encryption.
logsource:
  category: process_creation
  product: windows
detection:
  selection_tools:
    Image|endswith:
    - \\net.exe
    - \\net1.exe
    - \\sc.exe
    - \\taskkill.exe
  selection_action:
    CommandLine|contains:
    - ' stop '
    - /f /im
    - config
  selection_targets:
    CommandLine|contains:
    - vss
    - sql
    - backup
    - veeam
    - sophos
    - mcshield
    - defender
    - memtas
    - sql server
  condition: selection_tools and selection_action and selection_targets
falsepositives:
- Legitimate IT administration scripts stopping backup or security services during
  maintenance windows
- Software uninstallation processes that stop related services before removal
level: medium
tags:
- attack.t1489
- attack.impact
author: Vorant

Shadow Copy and Backup Deletion Prior to Ransomware Encryption

ATT&CK T1486

Detects use of vssadmin, wmic, or wbadmin to delete shadow copies or disable backup/recovery options, a precursor step used by LockBit and similar ransomware to prevent data recovery before encryption. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Shadow Copy and Backup Deletion Prior to Ransomware Encryption
id: 528355cf-820a-5c8d-87ce-0f07c48e1285
status: experimental
description: Detects command-line deletion of Volume Shadow Copies or Windows backup
  catalogs using vssadmin, wmic, or wbadmin, a common precursor to ransomware encryption
  such as LockBit to prevent victims from recovering data without paying ransom.
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    Image|endswith:
    - \\vssadmin.exe
    - \\wmic.exe
    CommandLine|contains:
    - delete shadows
    - shadowcopy delete
  selection_wbadmin:
    Image|endswith: \\wbadmin.exe
    CommandLine|contains:
    - delete catalog
    - delete systemstatebackup
  condition: selection_vss or selection_wbadmin
falsepositives:
- Administrators manually clearing old shadow copies to reclaim disk space
- Backup software reconfiguration or catalog maintenance scripts
level: high
tags:
- attack.t1486
- attack.impact
author: Vorant

Mass File Rename with Ransom Extension Indicative of Encryption Activity

ATT&CK T1486

Detects high-volume file rename/write events adding a uniform unusual extension across many files in a short window, consistent with ransomware encryption routines such as LockBit. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Mass File Rename with Ransom Extension Indicative of Encryption
id: 6e933de3-80fc-5352-a6a7-7a0f64e28581
status: experimental
description: Detects file system events where numerous files across user or shared
  directories are renamed or written with a new, unrecognized uniform extension in
  a short time period, consistent with ransomware mass-encryption behavior such as
  that used by LockBit. Threshold/time-window correlation must be enforced by the
  SIEM (e.g., more than 50 renames with same new extension within 60 seconds from
  a single process).
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
    - .lockbit
    - .locked
    - .encrypted
    - .enc
  condition: selection
falsepositives:
- Legitimate file compression, encryption, or archival tools renaming files with similar
  extensions
- Backup software creating encrypted archive files with similar naming
level: medium
tags:
- attack.t1486
- attack.impact
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.fbi.gov/news/stories/fbi-cyber-lead-urges-potential-lockbit-victims-to-contact-internet-crime-complaint-center

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free