LockBit ransomware operation targets critical infrastructure globally
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
LockBit RaaS remains the world's most active ransomware variant; CISA and international partners release advisory with TTPs and defenses.
LockBit is a Ransomware-as-a-Service operation that has been the most deployed ransomware variant globally since 2022, with over 1,700 attacks documented in the U.S. alone since January 2020 and approximately $91M in ransoms paid. The operation recruits affiliates to conduct attacks across critical infrastructure sectors including financial services, healthcare, energy, government, education, food and agriculture, manufacturing, transportation, and emergency services. Affiliate-driven attacks exhibit significant variance in tactics and techniques, complicating defensive efforts. LockBit has evolved through multiple versions (LockBit 2.0, 3.0, Green, and Linux-ESXi variants) and employs double extortion: encrypting victim data and exfiltrating it to threaten publication on leak sites if ransom is not paid. As of Q1 2023, 1,653 alleged victims were listed on LockBit leak sites; however, this represents only a portion of total victims since unpaid victims may not be publicly listed. CISA, FBI, MS-ISAC, and international partners (ACSC, CCCS, NCSC-UK, ANSSI, BSI, CERT NZ, NCSC NZ) released this advisory mapping LockBit affiliate TTPs across the MITRE ATT&CK framework and providing comprehensive mitigation recommendations aligned with Cross-Sector Cybersecurity Performance Goals.
Mentioned in this report
Detection guidance
Local Account Created via net.exe
Detects net.exe or net1.exe creating a local user account with 'user /add', which ransomware affiliates use to create persistence or staging accounts. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Local Account Created via net.exe
id: c28ade9c-8ae7-58e9-802b-23b944884ee4
status: experimental
description: Detects net.exe or net1.exe creating a local user account with 'user
/add'. Ransomware affiliates such as LockBit affiliates create local accounts for
persistence and access. Generalises on the command pattern, not on account names.
tags:
- attack.persistence
- attack.t1136.001
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- \net.exe
- \net1.exe
CommandLine|contains|all:
- ' user '
- ' /add'
condition: selection
falsepositives:
- Administrators or provisioning scripts creating local service or break-glass accounts
- Lab or imaging automation that creates local users during build
level: medium
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-165a
Winlogon Shell or Userinit Value Modified to Non-Default
Detects changes to the Winlogon Shell or Userinit values, or Winlogon Notify subkeys, that set something other than the default binaries, a persistence method (Winlogon Helper DLL). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Winlogon Shell or Userinit Value Modified to Non-Default
id: d876d062-ef6a-53ed-9e57-03a7889cd3d0
status: experimental
description: Detects registry writes to the Winlogon Shell or Userinit values, or
the Winlogon Notify key, that set a non-default value. This is a persistence technique
(Winlogon Helper DLL) used by ransomware affiliates.
tags:
- attack.persistence
- attack.privilege-escalation
- attack.t1547.004
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains: \Microsoft\Windows NT\CurrentVersion\Winlogon\
TargetObject|endswith:
- \Shell
- \Userinit
selection_notify:
TargetObject|contains: \Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
filter_default:
Details:
- explorer.exe
- C:\Windows\system32\userinit.exe,
condition: (selection and not filter_default) or selection_notify
falsepositives:
- Custom shell replacements in kiosk or thin-client deployments
- Legacy security or credential-provider software registering Winlogon notification
packages
level: high
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-165a
Active Setup StubPath Registered by Non-Installer Process
Detects creation of an Active Setup Installed Components StubPath value by a process other than msiexec or TrustedInstaller, which is used for logon persistence. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Active Setup StubPath Registered by Non-Installer Process
id: 1f8bc56e-1357-53fe-a671-1fb7d8c001f7
status: experimental
description: Detects registry writes of an Active Setup Installed Components StubPath
value by processes other than standard installers. Active Setup runs the StubPath
command at user logon and is abused for persistence.
tags:
- attack.persistence
- attack.privilege-escalation
- attack.t1547.014
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains: \SOFTWARE\Microsoft\Active Setup\Installed Components\
TargetObject|endswith: \StubPath
filter_installers:
Image|endswith:
- \msiexec.exe
- \TrustedInstaller.exe
- \setup.exe
condition: selection and not filter_installers
falsepositives:
- Third-party application installers or updaters that register Active Setup components
outside msiexec
- Software deployment agents configuring per-user first-run actions
level: medium
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-165a
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-165a
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs