Lockbit 2.0

November 3, 2021

Topics

Cybersecurity
Ransomware

Previously known as ABCD ransomware, LockBit 2.0 is a group that operates as a Ransomware as a Service (RaaS). The group has been in operation since 2019 while being known as just LockBit. They had temporarily ceased operations due to increased attention from law enforcement, however, by late-2020 the group resurfaced with an updated ransomware, new affiliate program, and a change in infrastructure. With all the changes and updates, the group renamed themselves as LockBit 2.0. Since their resurface, the LockBit gang has quietly and gradually amassed myriads of victims and continue to do so thanks to their successful affiliate program.

LockBit 2.0 Ransomware

Much of LockBit’s functionality remained the same in the updated version 2.0. It has a similar encryption routine and a hybrid AES/RSA encryption approach. A major change in this new version of LockBit is the deployment method, which deploys itself to Microsoft Active Directory clients via Group Policy Objects (GPO). When the payload is executed on an AD Domain Controller, the ransomware creates several GPOs to carry out the infection process. The Windows Defender configuration is also altered to avoid detection. Once the LockBit 2.0 ransomware is deployed and executed, the group claims they have the fastest exfiltration and encryption speed. The group claims their information stealer malware, StealBit, is the fastest exfiltration of data and files that only needs about 2 minutes to steal 10 GB of data. Their malware encryption speed tops all the other ransomware groups with the speed of 373 MB/s.Compared to REvil (37 MB/s) and Darkside (83 MB/s), LockBit proves to be superior in their encryption process.

Affiliate Program

When LockBit returned as Lockbit 2.0, they created a new affiliate program. This new program proved to be extremely successful and may be what separates them from their rivals REvil and Darkside. In recent DarkWeb chatter, members of the Russian forum .XSS claim that REvil created a backdoor in their ransomware to intercept communication between the victim and their affiliate member. Using this backdoor, REvil would handle the ransom negotiations, take the money, and leave their affiliate partner with nothing.

In an interview between a representative from LockBit and the Russian OSINT YouTube Channel, the LockBit representative explains their high business standards and the strength of their internal structure. The LockBit representative also takes shots at DarkSide and REvil for their scams of their respective partners. “Our program lets affiliates handle negotiation processes with encrypted companies. Thus, we are not cheating anyone for money like Avaddon, DarkSide, and REvil did.”

It is highly noted in the underground community of the distrust of RaaS groups due the actions of REvil and DarkSide. However, LockBit’s approach to pacify this distrust is noteworthy. According to their representative, LockBit ransom payment is made entirely to the affiliate’s wallet. The affiliate then transfers 20% of the payment to LockBit leadership. This approach will help to improve relationships with future and existing affiliates and amend ransomware reputation across the underground community.

The LockBit group is also amongst the first ransomware group to seek disgruntled employees to help deploy their payload. When the top DarkWeb forums started to ban ransomware talks, LockBit started to seek insider help with the promise of a large sum payment. It is believed this tactic was deployed in LockBit’s attack on Accenture, a major consulting company specializing in IT services. More than 6TB of data was stolen and a $50 million USD ransom was demanded. According to LockBit, their initial access was thanks to an employee aiding them. This tactic is beneficial for ransomware groups as they do not have to pay for “pentesters” and gaining initial access is easier with an insider.

Conclusion

While Darkside may have been rebranded as DarkMatter and REvil is currently offline again, the LockBit gang is on the rise. With an updated ransomware and a stronger affiliate program, the LockBit gang has amassed myriads victims.

To avoid possible attacks from the LockBit ransomware, here are some suggestions:

Implement strong password policies with multi-factor authentication enabled.
Use a reputed anti-virus feature on your devices.
Implement a strong email security policy and to refrain from opening any untrusted links or attachments without verifying their authenticity.
Conduct regular backup practices and keep those backups offline or in a separate network.

Indicator of Compromise (IoCs)

Commands

bcdedit /set {default} bootstatuspolicy ignoreallfailures
bcdedit /set {default} recoveryenabled no
%WINDIR%\SysWOW64\mshta.exe %HOMEPATH%\Desktop\LockBit_Ransomware.hta
vssadmin delete shadows /all /quiet
wmic shadowcopy delete

Files (SHA256)

0545f842ca2eb77bcac0fd17d6d0a8c607d7dbc8669709f3096e5c1828e1c049
0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d
bcbb1e388759eea5c1fbb4f35c29b6f66f3f4ca4c715bab35c8fc56dcf3fa621
d089d57b8b2b32ee9816338e96680127babc5d08a03150740a8459c29ab3ba78
f32e9fb8b1ea73f0a71f3edaebb7f2b242e72d2a4826d6b2744ad3d830671202
90f3a33919fdd766e90fd96f8f20a92c2d1376b7cfdc8b738c2f8e7e6c7498b1

URLs

hxxp://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd[.]onion
hxxp://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did[.]onion
hxxp://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid[.]onion
hxxps://bigblog[.]at

hxxps://decoding[.]at

Lockbit 2.0

LockBit 2.0 Ransomware

Affiliate Program

Conclusion

Up Next

Black Cat Attack on UnitedHealth Group

Chinese Hackers Exploit FortiOS Vulnerability