In September 2021, Avertium published a threat intelligence report featuring ransomware gang, LockBit 2.0, which is a variant of the original LockBit ransomware gang. LockBit 2.0 uses ransomware-as-a-service (RaaS) and has been active in Russian-language cybercrime forums since September 2021.
In their previous attacks, LockBit 2.0 relied on tools such as Windows PowerShell and Server Message Block (SMB) to attack organizations – scanning networks to infect compromised devices. Also, the threat actor used tools that were built-in to Windows systems - sometimes called Living off the Land Binaries, or LoLBins. They also used the double extortion model, which involves locating and exfiltrating sensitive and confidential information before a system is encrypted – ensuring that the stolen data gives victims an incentive to pay the requested ransom.
On Friday, February 4, 2022, the FBI released technical details and new indicators of compromise associated with LockBit 2.0. The threat actors successfully breach enterprise networks by compromising them through unpatched vulnerabilities, zero-day exploits, and insider access. They are also known to purchase access to networks from “access brokers”.
Once inside the networks, LockBit 2.0 uses publicly available penetration-testing tools (Mimikatz) for privilege escalation. They have been using a combination of custom and off-the shelf tools to exfiltrate data, before using the LockBit ransomware to encrypt files. In January 2022, LockBit 2.0 began targeting VMware ESXi servers by adding a Linux encryptor to their toolkit.
Before encryption, Lockbit 2.0 affiliates use Stealbit (obtained from the LockBit panel) to exfiltrate specific file types. This allows the attackers to configure the desired file types that will be copied to an attacker-controlled server over HTTP. Additionally, LockBit 2.0 deletes shadow copies and log files, harvests system information and encrypts all data on local and remote drives. It skips files used for core system functions and deletes itself from the disk - creating persistence at startup. So far, LockBit 2.0 has claimed to have successfully attack PayBito. They stole the data of about 100,000 customers and have threatened to publish the data online if their ransom isn’t paid by February 21, 2022.
Related Resource: A Comprehensive Guide to Ransomware
You can find more IoCs related to LockBit 2.0, here.