BITWISE SPIDER

Also known as: BITWISE SPIDER, Bitwise Spider, Gold Mystic, Operation “Cronos”, White Janus

BITWISE SPIDER has recently and quickly become a significant player in the big game hunting (BGH) landscape. Their dedicated leak site (DLS) has received the highest number of victims posted each month since July 2021 compared to other adversary DLSs due to the growing popularity and effectiveness of LockBit 2.0.

🌍 Country ["[Unknown]"]

Associated Operations

' uses new Conti-based encryptor 000 individuals 2020-05 2020-08 2020-09 2020-12 2021-04 2021-06 2021-08 2021-09 2021-10 2021-11 2022-01 2022-02 2022-03 2022-04 2022-05 2022-06 2022-07 2022-08 2022-09 2022-10 2022-11 2022-12 2023-01 2023-02 2023-03 2023-04 2023-05 2023-06 2023-07 2023-08 2023-09 2023-10 2023-11 2023-12 2024-01 2024-02 2024-03 2024-04 2024-05 2024-06 2024-07 2024-12 2025-02 2025-04 3AM: New Ransomware Family Used As Fallback in Failed LockBit Attack Accenture confirms hack after LockBit ransomware data leak threats Alleged LockBit attack shuts down city networks in Seville Bangkok Air confirms passenger PII leak after ransomware attack BlackMatter ransomware moves victims to LockBit after shutdown Boeing confirms cyberattack amid LockBit ransomware claims Bridgestone Americas confirms ransomware attack CDW data to be leaked next week after negotiations with LockBit break down California city declares ransomware emergency California city investigating data theft after ransomware group’s claims California community college Río Hondo dealing with cybersecurity incident California union confirms ransomware attack following LockBit claims Canadian fighter jet training company investigating ransomware attack Canadian government discloses data breach after contractor hacks Capital Health attack claimed by LockBit ransomware City of Wichita breach claimed by LockBit ransomware gang DC city agency says LockBit claims tied to third-party attack Darktrace: Investigation found no evidence of LockBit breach Data stolen from Florida sheriff’s office leaked by LockBit ransomware group December cyberattack on Chicago community hospital claimed by LockBit gang Egyptian E-Payment Vendor Recovering From LockBit Ransomware Attack Energy group ERG reports minor disruptions after ransomware attack Foxconn confirms ransomware attack disrupted production in Mexico Freight giant Estes refuses to deliver ransom French hospital CHC-SV refuses to pay LockBit extortion demand French telecom company La Poste Mobile struggling to recover from ransomware attack Georgia Hive Industrial and Commercial Bank of China dealing with LockBit ransomware attack Infamous ransomware group claims it hacked France’s Justice Ministry Infosys McCamish says LockBit stole data of 6 million people Interpol: Lockbit ransomware attacks affecting American SMBs Italy Jacksonville Beach and other US municipalities report data breaches following cyberattacks Japanese tech firm Oomiya hit by LockBit 3.0. Multiple supply chains potentially impacted Kyocera AVX says ransomware attack impacted 39 LockBit 2.0 posted a notice to the dark web portal it uses to identify and extort its victims saying it had files from the Bulgarian State Agency for Refugees under the Council of Ministers. LockBit 2.0 ransomware hit Israeli defense firm E.M.I.T. Aviation Consulting LockBit 2.0 ransomware incidents in Australia LockBit 2.0: Ransomware Attacks Surge After Successful Affiliate Recruitment LockBit 3.0 Leaks 600 GBs of Data Stolen From Indian Lender LockBit 3.0 Says It's Holding a Canadian City for Ransom LockBit 3.0 gang claims to have stolen data from Kearney & Company LockBit 3.0 gives Sick Kids free decryptor LockBit 3.0 introduces the first ransomware bug bounty program LockBit Attempts to Stay Afloat With a New Version LockBit Green and phishing that targets organizations LockBit Leaks 1.5TB of Data Stolen From Indonesia's BSI Bank LockBit Ransomware Disguised as Copyright Claim E-mail Being Distributed LockBit Ransomware Distributed via Word Files Disguised as Resumes LockBit Ransomware Wants to Hire Your Employees LockBit Resurfaces With Version 2.0 Ransomware Detections in Chile LockBit brags: We'll leak thousands of SpaceX blueprints stolen from supplier LockBit claims attack on California's Department of Finance LockBit claims ransomware attack on Fulton County LockBit claims ransomware attack on Italian tax agency LockBit claims ransomware attack on security giant Entrust LockBit gang takes credit for attack on water utility in Portugal LockBit group claims the hack of the Fairfield Memorial Hospital in the US LockBit leaks data LockBit leaks data stolen from the South Korean National Tax Service LockBit lied: Stolen data is from a bank LockBit ransomware claims Essendant attack LockBit ransomware claims attack on Continental automotive giant LockBit ransomware encryptors found targeting Mac devices LockBit ransomware gang claims PayBito crypto exchange as new victim LockBit ransomware gang claims Royal Mail cyberattack LockBit ransomware gang claims to have breached accountancy firm Xeinadin LockBit ransomware gang gets aggressive with triple-extortion tactic LockBit ransomware gang now also claims City of Oakland breach LockBit ransomware goes 'Green LockBit ransomware group assemble strike team to breach banks LockBit ransomware launches data leak site to double-extort victims LockBit ransomware now poaching BlackCat LockBit ransomware recruiting insiders to breach corporate networks LockBit ransomware returns LockBit ransomware self-spreads to quickly encrypt 225 systems LockBit ransomware used in attack on Ohio town’s court LockBit says they stole data in London Drugs ransomware attack LockBit takes credit for February shutdown of South African pension fund LockBit takes credit for November ransomware attack on Sacramento PBS station LockBit taunts FBI Director Kash Patel with alleged “Classified” leak threat LockBit updates leak site with post about Sud-Francilien hospital Lockbit Lockbit ransomware disrupts emergency care at German hospitals Los Angeles’ Housing Authority hit by LockBit Mandiant: “No evidence” we were hacked by LockBit ransomware Microsoft Exchange servers hacked to deploy LockBit ransomware Microsoft: Clop and LockBit ransomware behind PaperCut server hacks Montreal electricity organization latest victim in LockBit ransomware spree New LockBit Black Campaign Observed NoEscape affiliates Pendragon car dealer refuses $60 million LockBit ransomware demand Pharmaceutical development company investigating cyberattack after LockBit posting Physicians’ billing and revenue management firm hit by LockBit Port of Lisbon website still down as LockBit gang claims cyberattack Rail giant Wabtec discloses data breach after Lockbit ransomware attack Ransomware Talent Surges to Akira After LockBit's Demise Ransomware gang now lets you search their stolen data Ransomware hits helicopter maker Kopter Rio de Janeiro finance department hit with LockBit ransomware Royal Dutch Football Association says hackers stole employee data Russia-Linked LockBit Gang Attacks an MSP and Two Manufacturers Using the Targets' RMM Tools to Infect Downstream Customers and Employees with Ransomware Russia-linked cybercriminals target school for children with learning difficulties Sensitive Data about UK Military Sites Potentially Leaked by LockBit Shoe retailer Aldo says LockBit posting is related to system at franchise partner Siberia's largest dairy plant reportedly disrupted with LockBit variant Siemens Healthineers responds to alleged data theft by LockBit ransomware gang Spain warns of LockBit Locker ransomware phishing attacks Subway Puts a LockBit Investigation on the Menu TSMC denies LockBit hack as ransomware gang demands $70 million Taiwan Taiwanese semiconductor company hit by ransomware attack The LockBit ransomware gang claims to have breached the Commission des services electriques de Montréal (CSEM) The LockBit ransomware group threatens to leak medical data of cancer patients stolen from Varian Medical Systems The prolific Lockbit ransomware gang appears to have claimed another two scalps in recent days: the Canadian town of St Marys and the Italian tax agency. The ransomware attack on Westpole is disrupting digital services for Italian public administration Toronto school board confirms students’ info stolen as LockBit claims breach UK UK rail network Merseyrail likely hit by Lockbit ransomware Under Siege: Rapid7-Observed Exploitation of Cisco ASA SSL VPNs Upstate New York nonprofit hospitals still facing issues after LockBit ransomware attack Virginia County Confirms Personal Information Stolen in Ransomware Attack Virginia school district open despite LockBit ransomware attack Washington state public bus system confirms ransomware attack Wisconsin county dealing with ‘catastrophic software failure’ Zipper giant YKK confirms cyberattack targeted U.S. networks and BlackCat attack automotive supplier in triple ransomware attack claims to ban partner who attacked them company says “network outage” https://asec.ahnlab.com/en/35822/ https://asec.ahnlab.com/en/60633/ https://databreaches.net/2025/04/10/physicians-billing-and-revenue-management-firm-hit-by-lockbit/ https://doublepulsar.com/lockbit-ransomware-group-assemble-strike-team-to-breach-banks-law-firms-and-governments-4220580bfcee?gi=af98d89a956a https://krebsonsecurity.com/2024/02/fulton-county-security-experts-call-lockbits-bluff/ https://news.sophos.com/en-us/2022/08/10/lockbit-hive-and-blackcat-attack-automotive-supplier-in-triple-ransomware-attack/ https://securelist.com/crimeware-report-lockbit-switchsymb/110068/ https://securityaffairs.co/wordpress/122892/cyber-crime/e-m-i-t-aviation-consulting-ransomware.html https://securityaffairs.co/wordpress/137243/cyber-crime/oomiya-lockbit-3-0-ransomware.html https://securityaffairs.co/wordpress/138136/cyber-crime/lockbit-ransomware-kearney-company.html https://securityaffairs.com/144342/cyber-crime/lockbit-south-korean-national-tax-service.html https://securityaffairs.com/149307/cyber-crime/varian-medical-systems-lockbit-ransomware.html https://securityaffairs.com/150247/cyber-crime/lockbit-ransomware-csem.html https://securityaffairs.com/156090/cyber-crime/westpole-ransomware-attack.html https://securityaffairs.com/156303/cyber-crime/lockbit-gang-xeinadin.html https://securityaffairs.com/165162/cyber-crime/lockbit-ransomware-fairfield-memorial-hospital.html https://securityaffairs.com/174639/cyber-crime/lockbit-taunts-fbi-director-kash-patel.html https://securityintelligence.com/posts/lockbit-ransomware-attacks-surge-affiliate-recruitment/ https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/3am-ransomware-lockbit https://therecord.media/aldo-franchise-partner-lockbit-ransomware-posting https://therecord.media/bangkok-air-confirms-passenger-pii-leak-after-ransomware-attack/ https://therecord.media/california-city-el-cerrito-investigates-data-theft-lockbit https://therecord.media/california-college-rio-hondo-cyberattack https://therecord.media/california-union-lockbit-attack-ransomware https://therecord.media/dc-city-agency-ransomware-attack-lockbit https://therecord.media/dutch-football-association-paid-ransom-lockbit https://therecord.media/florida-sheriff-data-leak-lockbit-ransomware https://therecord.media/foxsemicon-ransomware-attack-taiwan https://therecord.media/french-telecom-company-la-poste-mobile-struggling-to-recover-from-ransomware-attack/ https://therecord.media/icbc-dealing-with-ransomware-attack https://therecord.media/jacksonville-beach-municipalities-hit-by-cyberattacks https://therecord.media/lockbit-cyberattack-shuts-down-networks-in-seville-spain https://therecord.media/lockbit-ransomware-group-attacks-ohio-towns-court-police-department-and-more/ https://therecord.media/lockbit-ransomware-takes-credit-for-south-african-pension-fund-attack https://therecord.media/lockbit-takes-credit-kvie-pbs-ransomware/ https://therecord.media/montreal-electricity-organization-lockbit-victim https://therecord.media/netherlands-dutch-football-association-cyberattack-soccer https://therecord.media/pharmaceutical-development-company-investigating-cyber-incident-lockbit https://therecord.media/pierce-transit-washington-ransomware-attack-lockbit https://therecord.media/port-of-lisbon-website-still-down-as-lockbit-gang-claims-cyberattack/ https://therecord.media/porto-portugal-water-utility-cyberattack-lockbit https://therecord.media/ransomware-saint-anthony-hospital-chicago https://therecord.media/rio-de-janeiro-finance-department-hit-with-lockbit-ransomware/ https://therecord.media/russian-cybercriminals-target-uk-school https://therecord.media/siberia-dairy-plant-cyberattack-lockbit-variant https://therecord.media/siemens-healthineers-alleged-ransomware-incident-lockbit https://therecord.media/top-aces-ransomware-attack-lockbit/ https://therecord.media/toronto-school-district-board-ransomware https://therecord.media/upstate-new-york-hospitals-ransomware-attack https://therecord.media/virginia-school-district-open-lockbit https://therecord.media/wisconsin-county-dealing-with-software-failure https://therecord.media/ykk-zipper-manufacturer-cyberattack-us-operations https://www.bankinfosecurity.com/lockbit-30-leaks-600-gbs-data-stolen-from-indian-lender-a-22010 https://www.bankinfosecurity.com/lockbit-30-says-its-holding-canadian-city-for-ransom-a-20529 https://www.bankinfosecurity.com/lockbit-leaks-15tb-data-stolen-from-indonesias-bsi-bank-a-22110 https://www.bankinfosecurity.com/ransomware-talent-surges-to-akira-after-lockbits-demise-a-24583 https://www.bleepingcomputer.com/news/security/accenture-confirms-hack-after-lockbit-ransomware-data-leak-threats/ https://www.bleepingcomputer.com/news/security/affirm-says-cardholders-impacted-by-evolve-bank-data-breach/ https://www.bleepingcomputer.com/news/security/blackmatter-ransomware-moves-victims-to-lockbit-after-shutdown/ https://www.bleepingcomputer.com/news/security/boeing-confirms-cyberattack-amid-lockbit-ransomware-claims/ https://www.bleepingcomputer.com/news/security/bridgestone-americas-confirms-ransomware-attack-lockbit-leaks-data/ https://www.bleepingcomputer.com/news/security/canadian-government-discloses-data-breach-after-contractor-hacks/ https://www.bleepingcomputer.com/news/security/capital-health-attack-claimed-by-lockbit-ransomware-risk-of-data-leak/ https://www.bleepingcomputer.com/news/security/city-of-wichita-breach-claimed-by-lockbit-ransomware-gang/ https://www.bleepingcomputer.com/news/security/darktrace-investigation-found-no-evidence-of-lockbit-breach/ https://www.bleepingcomputer.com/news/security/energy-group-erg-reports-minor-disruptions-after-ransomware-attack/ https://www.bleepingcomputer.com/news/security/foxconn-confirms-ransomware-attack-disrupted-production-in-mexico/ https://www.bleepingcomputer.com/news/security/french-hospital-chc-sv-refuses-to-pay-lockbit-extortion-demand/ https://www.bleepingcomputer.com/news/security/infosys-mccamish-says-lockbit-stole-data-of-6-million-people/ https://www.bleepingcomputer.com/news/security/interpol-lockbit-ransomware-attacks-affecting-american-smbs/ https://www.bleepingcomputer.com/news/security/kyocera-avx-says-ransomware-attack-impacted-39-000-individuals/ https://www.bleepingcomputer.com/news/security/lockbit-30-introduces-the-first-ransomware-bug-bounty-program/ https://www.bleepingcomputer.com/news/security/lockbit-claims-attack-on-californias-department-of-finance/ https://www.bleepingcomputer.com/news/security/lockbit-claims-ransomware-attack-on-fulton-county-georgia/ https://www.bleepingcomputer.com/news/security/lockbit-claims-ransomware-attack-on-italian-tax-agency/ https://www.bleepingcomputer.com/news/security/lockbit-claims-ransomware-attack-on-security-giant-entrust-leaks-data/ https://www.bleepingcomputer.com/news/security/lockbit-lied-stolen-data-is-from-a-bank-not-us-federal-reserve/ https://www.bleepingcomputer.com/news/security/lockbit-ransomware-claims-attack-on-continental-automotive-giant/ https://www.bleepingcomputer.com/news/security/lockbit-ransomware-claims-essendant-attack-company-says-network-outage-/ https://www.bleepingcomputer.com/news/security/lockbit-ransomware-disrupts-emergency-care-at-german-hospitals/ https://www.bleepingcomputer.com/news/security/lockbit-ransomware-encryptors-found-targeting-mac-devices/ https://www.bleepingcomputer.com/news/security/lockbit-ransomware-gang-claims-royal-mail-cyberattack/ https://www.bleepingcomputer.com/news/security/lockbit-ransomware-gang-gets-aggressive-with-triple-extortion-tactic/ https://www.bleepingcomputer.com/news/security/lockbit-ransomware-gang-now-also-claims-city-of-oakland-breach/ https://www.bleepingcomputer.com/news/security/lockbit-ransomware-goes-green-uses-new-conti-based-encryptor/ https://www.bleepingcomputer.com/news/security/lockbit-ransomware-launches-data-leak-site-to-double-extort-victims/ https://www.bleepingcomputer.com/news/security/lockbit-ransomware-leaks-gigabytes-of-boeing-data/ https://www.bleepingcomputer.com/news/security/lockbit-ransomware-now-poaching-blackcat-noescape-affiliates/ https://www.bleepingcomputer.com/news/security/lockbit-ransomware-recruiting-insiders-to-breach-corporate-networks/ https://www.bleepingcomputer.com/news/security/lockbit-ransomware-returns-restores-servers-after-police-disruption/ https://www.bleepingcomputer.com/news/security/lockbit-ransomware-returns-to-attacks-with-new-encryptors-servers/ https://www.bleepingcomputer.com/news/security/lockbit-ransomware-self-spreads-to-quickly-encrypt-225-systems/ https://www.bleepingcomputer.com/news/security/lockbit-says-they-stole-data-in-london-drugs-ransomware-attack/ https://www.bleepingcomputer.com/news/security/mandiant-no-evidence-we-were-hacked-by-lockbit-ransomware/ https://www.bleepingcomputer.com/news/security/microsoft-clop-and-lockbit-ransomware-behind-papercut-server-hacks/ https://www.bleepingcomputer.com/news/security/microsoft-exchange-servers-hacked-to-deploy-lockbit-ransomware/ https://www.bleepingcomputer.com/news/security/pendragon-car-dealer-refuses-60-million-lockbit-ransomware-demand/ https://www.bleepingcomputer.com/news/security/rail-giant-wabtec-discloses-data-breach-after-lockbit-ransomware-attack/ https://www.bleepingcomputer.com/news/security/ransomware-gang-now-lets-you-search-their-stolen-data/ https://www.bleepingcomputer.com/news/security/spain-warns-of-lockbit-locker-ransomware-phishing-attacks/ https://www.bleepingcomputer.com/news/security/tsmc-denies-lockbit-hack-as-ransomware-gang-demands-70-million/ https://www.bleepingcomputer.com/news/security/uk-rail-network-merseyrail-likely-hit-by-lockbit-ransomware/ https://www.cyber.gov.au/acsc/view-all-content/alerts/lockbit-20-ransomware-incidents-australia https://www.cyber.nj.gov/Home/Components/News/News/1312/214?fsiteid=2&loadingmode=PreviewContent https://www.cybereason.com/blog/lockbit-ransomware-wants-to-hire-your-employees https://www.cyberscoop.com/lockbit-ransomware-attack-bulgarian-refugee-agency/ https://www.darkreading.com/cyberattacks-data-breaches/fawry-recovering-from-lockbit-ransomware-attack- https://www.darkreading.com/cyberattacks-data-breaches/subway-lockbit-investigation-on-menu https://www.databreaches.net/breaking-lockbit-3-0-gives-sick-kids-free-decryptor-claims-to-ban-partner-who-attacked-them/ https://www.databreaches.net/lockbit-updates-leak-site-with-post-about-sud-francilien-hospital/ https://www.databreaches.net/los-angeles-housing-authority-hit-by-lockbit-claim/ https://www.esentire.com/blog/russia-linked-lockbit-ransomware-gang-attacks-an-msp-and-two-manufacturers-using-the-targets-rmm-tools-to-infect-downstream-customers-and-employees-with-ransomware https://www.hackread.com/lockbit-ransomware-paybito-crypto-exchange-hack/ https://www.infosecurity-magazine.com/news/lockbit-ramps-up-attacks-on-public/ https://www.infosecurity-magazine.com/news/sensitive-data-uk-army-potentially/ https://www.politico.eu/article/infamous-ransomware-group-claims-it-hacked-frances-justice-ministry/ https://www.rapid7.com/blog/post/2023/08/29/under-siege-rapid7-observed-exploitation-of-cisco-asa-ssl-vpns/ https://www.securityweek.com/virginia-county-confirms-personal-information-stolen-ransomware-attack https://www.theregister.com/2023/03/13/lockbit_spacex_ransomware/ https://www.theregister.com/2023/10/06/cdw_lockbit_negotiations/ https://www.theregister.com/2024/01/03/estes_ransomware/ https://www.trendmicro.com/en_us/research/21/h/lockbit-resurfaces-with-version-2-0-ransomware-detections-in-chi.html https://www.trendmicro.com/en_us/research/24/b/lockbit-attempts-to-stay-afloat-with-a-new-version.html https://www.zdnet.com/article/ransomware-hits-helicopter-maker-kopter/ law firms and governments leaks data not US Federal Reserve police department and more restores servers after police disruption risk of data leak says personal data opened and stolen

Introduction

BITWISE SPIDER has recently and quickly become a significant player in the big game hunting (BGH) landscape. Their dedicated leak site (DLS) has received the highest number of victims posted each month since July 2021 compared to other adversary DLSs due to the growing popularity and effectiveness of LockBit 2.0.

Activities and Tactics

Country of Origin: 🏳️ [“[Unknown]”]

Notable Campaigns

  • ’ uses new Conti-based encryptor
  • 000 individuals
  • 2020-05
  • 2020-08
  • 2020-09
  • 2020-12
  • 2021-04
  • 2021-06
  • 2021-08
  • 2021-09
  • 2021-10
  • 2021-11
  • 2022-01
  • 2022-02
  • 2022-03
  • 2022-04
  • 2022-05
  • 2022-06
  • 2022-07
  • 2022-08
  • 2022-09
  • 2022-10
  • 2022-11
  • 2022-12
  • 2023-01
  • 2023-02
  • 2023-03
  • 2023-04
  • 2023-05
  • 2023-06
  • 2023-07
  • 2023-08
  • 2023-09
  • 2023-10
  • 2023-11
  • 2023-12
  • 2024-01
  • 2024-02
  • 2024-03
  • 2024-04
  • 2024-05
  • 2024-06
  • 2024-07
  • 2024-12
  • 2025-02
  • 2025-04
  • 3AM: New Ransomware Family Used As Fallback in Failed LockBit Attack
  • Accenture confirms hack after LockBit ransomware data leak threats
  • Alleged LockBit attack shuts down city networks in Seville
  • Bangkok Air confirms passenger PII leak after ransomware attack
  • BlackMatter ransomware moves victims to LockBit after shutdown
  • Boeing confirms cyberattack amid LockBit ransomware claims
  • Bridgestone Americas confirms ransomware attack
  • CDW data to be leaked next week after negotiations with LockBit break down
  • California city declares ransomware emergency
  • California city investigating data theft after ransomware group’s claims
  • California community college Río Hondo dealing with cybersecurity incident
  • California union confirms ransomware attack following LockBit claims
  • Canadian fighter jet training company investigating ransomware attack
  • Canadian government discloses data breach after contractor hacks
  • Capital Health attack claimed by LockBit ransomware
  • City of Wichita breach claimed by LockBit ransomware gang
  • DC city agency says LockBit claims tied to third-party attack
  • Darktrace: Investigation found no evidence of LockBit breach
  • Data stolen from Florida sheriff’s office leaked by LockBit ransomware group
  • December cyberattack on Chicago community hospital claimed by LockBit gang
  • Egyptian E-Payment Vendor Recovering From LockBit Ransomware Attack
  • Energy group ERG reports minor disruptions after ransomware attack
  • Foxconn confirms ransomware attack disrupted production in Mexico
  • Freight giant Estes refuses to deliver ransom
  • French hospital CHC-SV refuses to pay LockBit extortion demand
  • French telecom company La Poste Mobile struggling to recover from ransomware attack
  • Georgia
  • Hive
  • Industrial and Commercial Bank of China dealing with LockBit ransomware attack
  • Infamous ransomware group claims it hacked France’s Justice Ministry
  • Infosys McCamish says LockBit stole data of 6 million people
  • Interpol: Lockbit ransomware attacks affecting American SMBs
  • Italy
  • Jacksonville Beach and other US municipalities report data breaches following cyberattacks
  • Japanese tech firm Oomiya hit by LockBit 3.0. Multiple supply chains potentially impacted
  • Kyocera AVX says ransomware attack impacted 39
  • LockBit 2.0 posted a notice to the dark web portal it uses to identify and extort its victims saying it had files from the Bulgarian State Agency for Refugees under the Council of Ministers.
  • LockBit 2.0 ransomware hit Israeli defense firm E.M.I.T. Aviation Consulting
  • LockBit 2.0 ransomware incidents in Australia
  • LockBit 2.0: Ransomware Attacks Surge After Successful Affiliate Recruitment
  • LockBit 3.0 Leaks 600 GBs of Data Stolen From Indian Lender
  • LockBit 3.0 Says It’s Holding a Canadian City for Ransom
  • LockBit 3.0 gang claims to have stolen data from Kearney & Company
  • LockBit 3.0 gives Sick Kids free decryptor
  • LockBit 3.0 introduces the first ransomware bug bounty program
  • LockBit Attempts to Stay Afloat With a New Version
  • LockBit Green and phishing that targets organizations
  • LockBit Leaks 1.5TB of Data Stolen From Indonesia’s BSI Bank
  • LockBit Ransomware Disguised as Copyright Claim E-mail Being Distributed
  • LockBit Ransomware Distributed via Word Files Disguised as Resumes
  • LockBit Ransomware Wants to Hire Your Employees
  • LockBit Resurfaces With Version 2.0 Ransomware Detections in Chile
  • LockBit brags: We’ll leak thousands of SpaceX blueprints stolen from supplier
  • LockBit claims attack on California’s Department of Finance
  • LockBit claims ransomware attack on Fulton County
  • LockBit claims ransomware attack on Italian tax agency
  • LockBit claims ransomware attack on security giant Entrust
  • LockBit gang takes credit for attack on water utility in Portugal
  • LockBit group claims the hack of the Fairfield Memorial Hospital in the US
  • LockBit leaks data
  • LockBit leaks data stolen from the South Korean National Tax Service
  • LockBit lied: Stolen data is from a bank
  • LockBit ransomware claims Essendant attack
  • LockBit ransomware claims attack on Continental automotive giant
  • LockBit ransomware encryptors found targeting Mac devices
  • LockBit ransomware gang claims PayBito crypto exchange as new victim
  • LockBit ransomware gang claims Royal Mail cyberattack
  • LockBit ransomware gang claims to have breached accountancy firm Xeinadin
  • LockBit ransomware gang gets aggressive with triple-extortion tactic
  • LockBit ransomware gang now also claims City of Oakland breach
  • LockBit ransomware goes ‘Green
  • LockBit ransomware group assemble strike team to breach banks
  • LockBit ransomware launches data leak site to double-extort victims
  • LockBit ransomware now poaching BlackCat
  • LockBit ransomware recruiting insiders to breach corporate networks
  • LockBit ransomware returns
  • LockBit ransomware self-spreads to quickly encrypt 225 systems
  • LockBit ransomware used in attack on Ohio town’s court
  • LockBit says they stole data in London Drugs ransomware attack
  • LockBit takes credit for February shutdown of South African pension fund
  • LockBit takes credit for November ransomware attack on Sacramento PBS station
  • LockBit taunts FBI Director Kash Patel with alleged “Classified” leak threat
  • LockBit updates leak site with post about Sud-Francilien hospital
  • Lockbit
  • Lockbit ransomware disrupts emergency care at German hospitals
  • Los Angeles’ Housing Authority hit by LockBit
  • Mandiant: “No evidence” we were hacked by LockBit ransomware
  • Microsoft Exchange servers hacked to deploy LockBit ransomware
  • Microsoft: Clop and LockBit ransomware behind PaperCut server hacks
  • Montreal electricity organization latest victim in LockBit ransomware spree
  • New LockBit Black Campaign Observed
  • NoEscape affiliates
  • Pendragon car dealer refuses $60 million LockBit ransomware demand
  • Pharmaceutical development company investigating cyberattack after LockBit posting
  • Physicians’ billing and revenue management firm hit by LockBit
  • Port of Lisbon website still down as LockBit gang claims cyberattack
  • Rail giant Wabtec discloses data breach after Lockbit ransomware attack
  • Ransomware Talent Surges to Akira After LockBit’s Demise
  • Ransomware gang now lets you search their stolen data
  • Ransomware hits helicopter maker Kopter
  • Rio de Janeiro finance department hit with LockBit ransomware
  • Royal Dutch Football Association says hackers stole employee data
  • Russia-Linked LockBit Gang Attacks an MSP and Two Manufacturers Using the Targets’ RMM Tools to Infect Downstream Customers and Employees with Ransomware
  • Russia-linked cybercriminals target school for children with learning difficulties
  • Sensitive Data about UK Military Sites Potentially Leaked by LockBit
  • Shoe retailer Aldo says LockBit posting is related to system at franchise partner
  • Siberia’s largest dairy plant reportedly disrupted with LockBit variant
  • Siemens Healthineers responds to alleged data theft by LockBit ransomware gang
  • Spain warns of LockBit Locker ransomware phishing attacks
  • Subway Puts a LockBit Investigation on the Menu
  • TSMC denies LockBit hack as ransomware gang demands $70 million
  • Taiwan
  • Taiwanese semiconductor company hit by ransomware attack
  • The LockBit ransomware gang claims to have breached the Commission des services electriques de Montréal (CSEM)
  • The LockBit ransomware group threatens to leak medical data of cancer patients stolen from Varian Medical Systems
  • The prolific Lockbit ransomware gang appears to have claimed another two scalps in recent days: the Canadian town of St Marys and the Italian tax agency.
  • The ransomware attack on Westpole is disrupting digital services for Italian public administration
  • Toronto school board confirms students’ info stolen as LockBit claims breach
  • UK
  • UK rail network Merseyrail likely hit by Lockbit ransomware
  • Under Siege: Rapid7-Observed Exploitation of Cisco ASA SSL VPNs
  • Upstate New York nonprofit hospitals still facing issues after LockBit ransomware attack
  • Virginia County Confirms Personal Information Stolen in Ransomware Attack
  • Virginia school district open despite LockBit ransomware attack
  • Washington state public bus system confirms ransomware attack
  • Wisconsin county dealing with ‘catastrophic software failure’
  • Zipper giant YKK confirms cyberattack targeted U.S. networks
  • and BlackCat attack automotive supplier in triple ransomware attack
  • claims to ban partner who attacked them
  • company says “network outage”
  • https://asec.ahnlab.com/en/35822/
  • https://asec.ahnlab.com/en/60633/
  • https://databreaches.net/2025/04/10/physicians-billing-and-revenue-management-firm-hit-by-lockbit/
  • https://doublepulsar.com/lockbit-ransomware-group-assemble-strike-team-to-breach-banks-law-firms-and-governments-4220580bfcee?gi=af98d89a956a
  • https://krebsonsecurity.com/2024/02/fulton-county-security-experts-call-lockbits-bluff/
  • https://news.sophos.com/en-us/2022/08/10/lockbit-hive-and-blackcat-attack-automotive-supplier-in-triple-ransomware-attack/
  • https://securelist.com/crimeware-report-lockbit-switchsymb/110068/
  • https://securityaffairs.co/wordpress/122892/cyber-crime/e-m-i-t-aviation-consulting-ransomware.html
  • https://securityaffairs.co/wordpress/137243/cyber-crime/oomiya-lockbit-3-0-ransomware.html
  • https://securityaffairs.co/wordpress/138136/cyber-crime/lockbit-ransomware-kearney-company.html
  • https://securityaffairs.com/144342/cyber-crime/lockbit-south-korean-national-tax-service.html
  • https://securityaffairs.com/149307/cyber-crime/varian-medical-systems-lockbit-ransomware.html
  • https://securityaffairs.com/150247/cyber-crime/lockbit-ransomware-csem.html
  • https://securityaffairs.com/156090/cyber-crime/westpole-ransomware-attack.html
  • https://securityaffairs.com/156303/cyber-crime/lockbit-gang-xeinadin.html
  • https://securityaffairs.com/165162/cyber-crime/lockbit-ransomware-fairfield-memorial-hospital.html
  • https://securityaffairs.com/174639/cyber-crime/lockbit-taunts-fbi-director-kash-patel.html
  • https://securityintelligence.com/posts/lockbit-ransomware-attacks-surge-affiliate-recruitment/
  • https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/3am-ransomware-lockbit
  • https://therecord.media/aldo-franchise-partner-lockbit-ransomware-posting
  • https://therecord.media/bangkok-air-confirms-passenger-pii-leak-after-ransomware-attack/
  • https://therecord.media/california-city-el-cerrito-investigates-data-theft-lockbit
  • https://therecord.media/california-college-rio-hondo-cyberattack
  • https://therecord.media/california-union-lockbit-attack-ransomware
  • https://therecord.media/dc-city-agency-ransomware-attack-lockbit
  • https://therecord.media/dutch-football-association-paid-ransom-lockbit
  • https://therecord.media/florida-sheriff-data-leak-lockbit-ransomware
  • https://therecord.media/foxsemicon-ransomware-attack-taiwan
  • https://therecord.media/french-telecom-company-la-poste-mobile-struggling-to-recover-from-ransomware-attack/
  • https://therecord.media/icbc-dealing-with-ransomware-attack
  • https://therecord.media/jacksonville-beach-municipalities-hit-by-cyberattacks
  • https://therecord.media/lockbit-cyberattack-shuts-down-networks-in-seville-spain
  • https://therecord.media/lockbit-ransomware-group-attacks-ohio-towns-court-police-department-and-more/
  • https://therecord.media/lockbit-ransomware-takes-credit-for-south-african-pension-fund-attack
  • https://therecord.media/lockbit-takes-credit-kvie-pbs-ransomware/
  • https://therecord.media/montreal-electricity-organization-lockbit-victim
  • https://therecord.media/netherlands-dutch-football-association-cyberattack-soccer
  • https://therecord.media/pharmaceutical-development-company-investigating-cyber-incident-lockbit
  • https://therecord.media/pierce-transit-washington-ransomware-attack-lockbit
  • https://therecord.media/port-of-lisbon-website-still-down-as-lockbit-gang-claims-cyberattack/
  • https://therecord.media/porto-portugal-water-utility-cyberattack-lockbit
  • https://therecord.media/ransomware-saint-anthony-hospital-chicago
  • https://therecord.media/rio-de-janeiro-finance-department-hit-with-lockbit-ransomware/
  • https://therecord.media/russian-cybercriminals-target-uk-school
  • https://therecord.media/siberia-dairy-plant-cyberattack-lockbit-variant
  • https://therecord.media/siemens-healthineers-alleged-ransomware-incident-lockbit
  • https://therecord.media/top-aces-ransomware-attack-lockbit/
  • https://therecord.media/toronto-school-district-board-ransomware
  • https://therecord.media/upstate-new-york-hospitals-ransomware-attack
  • https://therecord.media/virginia-school-district-open-lockbit
  • https://therecord.media/wisconsin-county-dealing-with-software-failure
  • https://therecord.media/ykk-zipper-manufacturer-cyberattack-us-operations
  • https://www.bankinfosecurity.com/lockbit-30-leaks-600-gbs-data-stolen-from-indian-lender-a-22010
  • https://www.bankinfosecurity.com/lockbit-30-says-its-holding-canadian-city-for-ransom-a-20529
  • https://www.bankinfosecurity.com/lockbit-leaks-15tb-data-stolen-from-indonesias-bsi-bank-a-22110
  • https://www.bankinfosecurity.com/ransomware-talent-surges-to-akira-after-lockbits-demise-a-24583
  • https://www.bleepingcomputer.com/news/security/accenture-confirms-hack-after-lockbit-ransomware-data-leak-threats/
  • https://www.bleepingcomputer.com/news/security/affirm-says-cardholders-impacted-by-evolve-bank-data-breach/
  • https://www.bleepingcomputer.com/news/security/blackmatter-ransomware-moves-victims-to-lockbit-after-shutdown/
  • https://www.bleepingcomputer.com/news/security/boeing-confirms-cyberattack-amid-lockbit-ransomware-claims/
  • https://www.bleepingcomputer.com/news/security/bridgestone-americas-confirms-ransomware-attack-lockbit-leaks-data/
  • https://www.bleepingcomputer.com/news/security/canadian-government-discloses-data-breach-after-contractor-hacks/
  • https://www.bleepingcomputer.com/news/security/capital-health-attack-claimed-by-lockbit-ransomware-risk-of-data-leak/
  • https://www.bleepingcomputer.com/news/security/city-of-wichita-breach-claimed-by-lockbit-ransomware-gang/
  • https://www.bleepingcomputer.com/news/security/darktrace-investigation-found-no-evidence-of-lockbit-breach/
  • https://www.bleepingcomputer.com/news/security/energy-group-erg-reports-minor-disruptions-after-ransomware-attack/
  • https://www.bleepingcomputer.com/news/security/foxconn-confirms-ransomware-attack-disrupted-production-in-mexico/
  • https://www.bleepingcomputer.com/news/security/french-hospital-chc-sv-refuses-to-pay-lockbit-extortion-demand/
  • https://www.bleepingcomputer.com/news/security/infosys-mccamish-says-lockbit-stole-data-of-6-million-people/
  • https://www.bleepingcomputer.com/news/security/interpol-lockbit-ransomware-attacks-affecting-american-smbs/
  • https://www.bleepingcomputer.com/news/security/kyocera-avx-says-ransomware-attack-impacted-39-000-individuals/
  • https://www.bleepingcomputer.com/news/security/lockbit-30-introduces-the-first-ransomware-bug-bounty-program/
  • https://www.bleepingcomputer.com/news/security/lockbit-claims-attack-on-californias-department-of-finance/
  • https://www.bleepingcomputer.com/news/security/lockbit-claims-ransomware-attack-on-fulton-county-georgia/
  • https://www.bleepingcomputer.com/news/security/lockbit-claims-ransomware-attack-on-italian-tax-agency/
  • https://www.bleepingcomputer.com/news/security/lockbit-claims-ransomware-attack-on-security-giant-entrust-leaks-data/
  • https://www.bleepingcomputer.com/news/security/lockbit-lied-stolen-data-is-from-a-bank-not-us-federal-reserve/
  • https://www.bleepingcomputer.com/news/security/lockbit-ransomware-claims-attack-on-continental-automotive-giant/
  • https://www.bleepingcomputer.com/news/security/lockbit-ransomware-claims-essendant-attack-company-says-network-outage-/
  • https://www.bleepingcomputer.com/news/security/lockbit-ransomware-disrupts-emergency-care-at-german-hospitals/
  • https://www.bleepingcomputer.com/news/security/lockbit-ransomware-encryptors-found-targeting-mac-devices/
  • https://www.bleepingcomputer.com/news/security/lockbit-ransomware-gang-claims-royal-mail-cyberattack/
  • https://www.bleepingcomputer.com/news/security/lockbit-ransomware-gang-gets-aggressive-with-triple-extortion-tactic/
  • https://www.bleepingcomputer.com/news/security/lockbit-ransomware-gang-now-also-claims-city-of-oakland-breach/
  • https://www.bleepingcomputer.com/news/security/lockbit-ransomware-goes-green-uses-new-conti-based-encryptor/
  • https://www.bleepingcomputer.com/news/security/lockbit-ransomware-launches-data-leak-site-to-double-extort-victims/
  • https://www.bleepingcomputer.com/news/security/lockbit-ransomware-leaks-gigabytes-of-boeing-data/
  • https://www.bleepingcomputer.com/news/security/lockbit-ransomware-now-poaching-blackcat-noescape-affiliates/
  • https://www.bleepingcomputer.com/news/security/lockbit-ransomware-recruiting-insiders-to-breach-corporate-networks/
  • https://www.bleepingcomputer.com/news/security/lockbit-ransomware-returns-restores-servers-after-police-disruption/
  • https://www.bleepingcomputer.com/news/security/lockbit-ransomware-returns-to-attacks-with-new-encryptors-servers/
  • https://www.bleepingcomputer.com/news/security/lockbit-ransomware-self-spreads-to-quickly-encrypt-225-systems/
  • https://www.bleepingcomputer.com/news/security/lockbit-says-they-stole-data-in-london-drugs-ransomware-attack/
  • https://www.bleepingcomputer.com/news/security/mandiant-no-evidence-we-were-hacked-by-lockbit-ransomware/
  • https://www.bleepingcomputer.com/news/security/microsoft-clop-and-lockbit-ransomware-behind-papercut-server-hacks/
  • https://www.bleepingcomputer.com/news/security/microsoft-exchange-servers-hacked-to-deploy-lockbit-ransomware/
  • https://www.bleepingcomputer.com/news/security/pendragon-car-dealer-refuses-60-million-lockbit-ransomware-demand/
  • https://www.bleepingcomputer.com/news/security/rail-giant-wabtec-discloses-data-breach-after-lockbit-ransomware-attack/
  • https://www.bleepingcomputer.com/news/security/ransomware-gang-now-lets-you-search-their-stolen-data/
  • https://www.bleepingcomputer.com/news/security/spain-warns-of-lockbit-locker-ransomware-phishing-attacks/
  • https://www.bleepingcomputer.com/news/security/tsmc-denies-lockbit-hack-as-ransomware-gang-demands-70-million/
  • https://www.bleepingcomputer.com/news/security/uk-rail-network-merseyrail-likely-hit-by-lockbit-ransomware/
  • https://www.cyber.gov.au/acsc/view-all-content/alerts/lockbit-20-ransomware-incidents-australia
  • https://www.cyber.nj.gov/Home/Components/News/News/1312/214?fsiteid=2&loadingmode=PreviewContent
  • https://www.cybereason.com/blog/lockbit-ransomware-wants-to-hire-your-employees
  • https://www.cyberscoop.com/lockbit-ransomware-attack-bulgarian-refugee-agency/
  • https://www.darkreading.com/cyberattacks-data-breaches/fawry-recovering-from-lockbit-ransomware-attack-
  • https://www.darkreading.com/cyberattacks-data-breaches/subway-lockbit-investigation-on-menu
  • https://www.databreaches.net/breaking-lockbit-3-0-gives-sick-kids-free-decryptor-claims-to-ban-partner-who-attacked-them/
  • https://www.databreaches.net/lockbit-updates-leak-site-with-post-about-sud-francilien-hospital/
  • https://www.databreaches.net/los-angeles-housing-authority-hit-by-lockbit-claim/
  • https://www.esentire.com/blog/russia-linked-lockbit-ransomware-gang-attacks-an-msp-and-two-manufacturers-using-the-targets-rmm-tools-to-infect-downstream-customers-and-employees-with-ransomware
  • https://www.hackread.com/lockbit-ransomware-paybito-crypto-exchange-hack/
  • https://www.infosecurity-magazine.com/news/lockbit-ramps-up-attacks-on-public/
  • https://www.infosecurity-magazine.com/news/sensitive-data-uk-army-potentially/
  • https://www.politico.eu/article/infamous-ransomware-group-claims-it-hacked-frances-justice-ministry/
  • https://www.rapid7.com/blog/post/2023/08/29/under-siege-rapid7-observed-exploitation-of-cisco-asa-ssl-vpns/
  • https://www.securityweek.com/virginia-county-confirms-personal-information-stolen-ransomware-attack
  • https://www.theregister.com/2023/03/13/lockbit_spacex_ransomware/
  • https://www.theregister.com/2023/10/06/cdw_lockbit_negotiations/
  • https://www.theregister.com/2024/01/03/estes_ransomware/
  • https://www.trendmicro.com/en_us/research/21/h/lockbit-resurfaces-with-version-2-0-ransomware-detections-in-chi.html
  • https://www.trendmicro.com/en_us/research/24/b/lockbit-attempts-to-stay-afloat-with-a-new-version.html
  • https://www.zdnet.com/article/ransomware-hits-helicopter-maker-kopter/
  • law firms and governments
  • leaks data
  • not US Federal Reserve
  • police department and more
  • restores servers after police disruption
  • risk of data leak
  • says personal data opened and stolen

Tactics, Techniques, and Procedures (TTPs)

Information pending cataloguing.

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

  • 3AM:
  • CrackMapExec:
  • EmpireProject:
  • LockBit:
  • Mimikatz:
  • PsExec:

Attribution and Evidence

Country of Origin: [“[Unknown]”] Additional attribution information pending cataloguing.

References

References pending cataloguing.