Ransomware: “LockBit” Variants

Since January 2020, LockBit ransomware has functioned as an affiliate-based ransomware variant; affiliates deploying the LockBit Ransomware-as-a-Service (RaaS) use many varying tactics, techniques, and procedures (TTPs) and attack a wide range of businesses and critical infrastructure organizations, which can make effective computer network defense and mitigation challenging.  A new variant, LockBit 3.0, also known as “LockBit Black”, is more modular and evasive than its previous versions, LockBit 2.0 and LockBit, and shares similarities with Blackmatter and Blackcat ransomware.  Upon the actual execution of the ransomware within a victim environment, it can further modify the behavior of the ransomware.

A joint cybersecurity advisory (CSA), #StopRansomware: LockBit 3.0 was released recently which details known indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs) that the Federal Bureau of Investigation (FBI) investigations correlated with LockBit 3.0 ransomware as recently as March 2023.

Impact

LockBit operators mostly gain access via compromised system, credentials that are obtained from other hackers, phishing emails, or by abuse of (brute forcing) insecure credentials.  Once the LockBit, or it’s variants, are executed, it can:

1. Disable security solutions in the system by using tools like GMER and PC Hunter, some attacks would also create a group policy to disable Windows Defender.
2. Data exfiltration by using the malware StealBit, LockBit’s proprietary tool, and other tools automates data exfiltration in the latest variants and upload stolen files.
3. Steal credentials by using tools like Mimikatz to gather credentials.
4. Discovery and lateral movement by using tools like network scanner, PsExec or Cobalt Strike to discovery other systems and move laterally within a network.
5. Data Encryption by executing the encryption routine, encryption includes both local and network encryption and appends “.lockbit” to the file extension.
6. Replace the desktop wallpaper with a note that includes a message about the encryption.

Actions Preventing ‘LockBit’ Attack

Firewall

1. Enable your firewalls as well as intrusion detection and prevention systems.
2. Ensure latest signature has been applied on IPS.
3. Proactively monitor and validate the incoming and outgoing traffic of the network.

Clients & Servers

1. Ensure PC has up-to-date Windows and software updates.
2. Ensure up-to-date anti-virus signatures from your anti-virus software such as Kaspersky or Windows Defender updated.
3. Backup important files regularly and keep them in a separate and safe place.
4. Beware of phishing emails and DO NOT open email/attachments from unknown/untrusted source.
5. Ensure all accounts with strong and different password and enable 2FA.
6. Review the user accounts regularly.
7. Disable unused ports and services.
8. Disable command-line and scripting activities and permissions if possible.

Note: these are good security defense-in-depth recommendations for prevention of being infected, but these steps alone do not guarantee against infection.

As a Victim:

1. Disconnect the system from the network IMMEDIATELY.
2. DO NOT respond to any kidnapper by attempting payment and instead to report the incident to your departmental IT Support, ITSC and the Police.

Reference:

• • Joint Cybersecurity Advisory: StopRansomware: LockBit 3.0
  • CISA: Stop Ransomware
  • HKCERT: Fight ransomware
  • Kaspersky: LockBit ransomware — what is it and how to stay safe
  • Trend Micro: Ransomware Spotlight: LockBit

Related News:

• LA housing authority discloses data breach after ransomware attack (bleepingcomputer.com)
• Amadey Bot Spotted Deploying LockBit 3.0 Ransomware on Hacked Machines (thehackernews.com)
• 汽車零件大廠大陸集團疑似遭LockBit駭客竊取資料 | iThome
• 【網絡安全】富士康遭LockBit 2.0勒索軟件攻擊　墨西哥工廠暫停運作 – 香港經濟日報 – 即時新聞頻道 – 科技 – D220603 (hket.com)

Please visit here for more Information Security tips.

Published on: 17 Mar 2023