# LockBit ransomware operation targets critical infrastructure globally

Published: 2025-07-17 · Severity: high · Sectors: financial-services, healthcare, energy, government-national, education, manufacturing, transportation, infrastructure
Canonical: https://vorant.io/reports/c2b7a2d9-3acd-53a5-a1f8-55d767c9d311/lockbit-ransomware-operation-targets-critical-infrastructure-globally

> LockBit RaaS remains the world's most active ransomware variant; CISA and international partners release advisory with TTPs and defenses.

LockBit is a Ransomware-as-a-Service operation that has been the most deployed ransomware variant globally since 2022, with over 1,700 attacks documented in the U.S. alone since January 2020 and approximately $91M in ransoms paid. The operation recruits affiliates to conduct attacks across critical infrastructure sectors including financial services, healthcare, energy, government, education, food and agriculture, manufacturing, transportation, and emergency services. Affiliate-driven attacks exhibit significant variance in tactics and techniques, complicating defensive efforts. LockBit has evolved through multiple versions (LockBit 2.0, 3.0, Green, and Linux-ESXi variants) and employs double extortion: encrypting victim data and exfiltrating it to threaten publication on leak sites if ransom is not paid. As of Q1 2023, 1,653 alleged victims were listed on LockBit leak sites; however, this represents only a portion of total victims since unpaid victims may not be publicly listed. CISA, FBI, MS-ISAC, and international partners (ACSC, CCCS, NCSC-UK, ANSSI, BSI, CERT NZ, NCSC NZ) released this advisory mapping LockBit affiliate TTPs across the MITRE ATT&CK framework and providing comprehensive mitigation recommendations aligned with Cross-Sector Cybersecurity Performance Goals.

## Mentioned in this report

- Vulnerabilities: CVE-2018-13379 (KEV), CVE-2019-0708 (KEV), CVE-2020-1472 (KEV), CVE-2021-22986 (KEV), CVE-2021-44228 (KEV), CVE-2023-0669 (KEV), CVE-2023-27350 (KEV)
- Threat actors: LockBit
- Malware: LockBit, LockBit 2.0, LockBit 3.0

## Detection guidance (public sample)

### Local Account Created via net.exe

ATT&CK: T1136.001

Detects net.exe or net1.exe creating a local user account with 'user /add', which ransomware affiliates use to create persistence or staging accounts. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Local Account Created via net.exe
id: c28ade9c-8ae7-58e9-802b-23b944884ee4
status: experimental
description: Detects net.exe or net1.exe creating a local user account with 'user
  /add'. Ransomware affiliates such as LockBit affiliates create local accounts for
  persistence and access. Generalises on the command pattern, not on account names.
tags:
- attack.persistence
- attack.t1136.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
    - \net.exe
    - \net1.exe
    CommandLine|contains|all:
    - ' user '
    - ' /add'
  condition: selection
falsepositives:
- Administrators or provisioning scripts creating local service or break-glass accounts
- Lab or imaging automation that creates local users during build
level: medium
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-165a
```

### Winlogon Shell or Userinit Value Modified to Non-Default

ATT&CK: T1547.004

Detects changes to the Winlogon Shell or Userinit values, or Winlogon Notify subkeys, that set something other than the default binaries, a persistence method (Winlogon Helper DLL). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Winlogon Shell or Userinit Value Modified to Non-Default
id: d876d062-ef6a-53ed-9e57-03a7889cd3d0
status: experimental
description: Detects registry writes to the Winlogon Shell or Userinit values, or
  the Winlogon Notify key, that set a non-default value. This is a persistence technique
  (Winlogon Helper DLL) used by ransomware affiliates.
tags:
- attack.persistence
- attack.privilege-escalation
- attack.t1547.004
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains: \Microsoft\Windows NT\CurrentVersion\Winlogon\
    TargetObject|endswith:
    - \Shell
    - \Userinit
  selection_notify:
    TargetObject|contains: \Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
  filter_default:
    Details:
    - explorer.exe
    - C:\Windows\system32\userinit.exe,
  condition: (selection and not filter_default) or selection_notify
falsepositives:
- Custom shell replacements in kiosk or thin-client deployments
- Legacy security or credential-provider software registering Winlogon notification
  packages
level: high
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-165a
```

### Active Setup StubPath Registered by Non-Installer Process

ATT&CK: T1547.014

Detects creation of an Active Setup Installed Components StubPath value by a process other than msiexec or TrustedInstaller, which is used for logon persistence. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Active Setup StubPath Registered by Non-Installer Process
id: 1f8bc56e-1357-53fe-a671-1fb7d8c001f7
status: experimental
description: Detects registry writes of an Active Setup Installed Components StubPath
  value by processes other than standard installers. Active Setup runs the StubPath
  command at user logon and is abused for persistence.
tags:
- attack.persistence
- attack.privilege-escalation
- attack.t1547.014
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains: \SOFTWARE\Microsoft\Active Setup\Installed Components\
    TargetObject|endswith: \StubPath
  filter_installers:
    Image|endswith:
    - \msiexec.exe
    - \TrustedInstaller.exe
    - \setup.exe
  condition: selection and not filter_installers
falsepositives:
- Third-party application installers or updaters that register Active Setup components
  outside msiexec
- Software deployment agents configuring per-user first-run actions
level: medium
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-165a
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-165a

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/c2b7a2d9-3acd-53a5-a1f8-55d767c9d311/lockbit-ransomware-operation-targets-critical-infrastructure-globally.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup