This guide explains how to investigate a LockBit notice using evidence, official alerts, and verification checks. LockBit is an affiliate-based Ransomware-as-a-Service operation that provides malware to affiliates who attack businesses and critical infrastructure.
Affiliates use varied tactics, which complicates defense and incident review. A leak-site post alone does not prove theft or system compromise. Use ransom artifacts, logs, and trusted notices to decide impact.
Table of Contents
- What evidence should you preserve?
- Which official notices help detection?
- What did the takedown change for victims?
- How do you verify impact before acting?
What evidence should you preserve?
The FBI asks victims to preserve key artifacts in LockBit cases, as described in the joint CISA advisory joint CISA advisory AA23-075A. Save material before systems are rebuilt, accounts are reset, or logs rotate.
Keep original file names, timestamps, and headers intact. Match each artifact to a host and time. A ransom note links the variant, logs show entry and movement, and wallet or decryptor data helps investigators connect cases.
- Boundary and firewall logs around the suspected intrusion window
- Ransom-note files, file extensions, and affiliate messages
- Bitcoin wallet addresses, decryptor files, and encrypted samples of otherwise harmless files
Which official notices help detection?
Federal investigators published LockBit 3.0 indicators of compromise, tactics, and mitigations to help defenders find activity. Use those indicators to search endpoint, identity, firewall, and backup logs. Prioritize confirmed malicious IPs, hashes, tools, and behaviors over rumors or screenshots.
Affiliates also exploited CVE-2023-4966, called Citrix Bleed, in Citrix NetScaler ADC and Gateway for initial access, according to CISA, FBI, MS-ISAC, and ASD-ACSC in the Citrix Bleed advisory AA23-325A. Check patch history and external-access logs for those appliances. Unpatched public-facing devices deserve urgent review and containment.
What did the takedown change for victims?
Operation Cronos, led by the UK National Crime Agency with the FBI, Europol, Eurojust, and 10 countries, seized LockBit infrastructure and its leak site, according to the Europol disruption announcement. The action seized 34 servers, froze 200 crypto accounts, arrested two suspects, and recovered more than 1,000 decryption keys.
Japanese Police, the UK National Crime Agency, and the FBI used seized keys to build a free LockBit 3.0 Black decryption tool, distributed through the No More Ransom portal. In May 2024, the United States also unsealed a 26-count indictment against Russian national Dmitry Khoroshev as LockBitSupp, with a 10 million dollar reward for arrest information. A recovered decryptor helps only matching keys and variants, so check tool compatibility before assuming recovery.
How do you verify impact before acting?
Treat a leak-site listing as a public claim, not proof of compromise or data theft. Confirm a local ransom note, unusual file extensions, disabled recovery controls, exfiltration signs, and affected accounts.
Compare the claimed data sample with your own file inventory and access logs. Do not pay based on pressure or a countdown timer. Test decryptor identity checks first, restore from clean backups where possible, and preserve evidence for law enforcement. Report the incident to FBI IC3 or stopransomware.gov; the FBI states in its FBI ransomware guidance that it does not support paying ransom.
You Might Also Like
- Leak Site Ransomware Investigation Guide: Evidence, Notices, and Verification
- Cybersecurity — RaaS Prevention Guide: Controls, Monitoring, and Recovery
- Cybersecurity — Extortion Demand Prevention Guide: Controls, Monitoring, and Recovery