THREAT‑WATCH
Threat Actors
LockBit
LockBit Black, LockBit 3.0
A ransomware-as-a-service operation that was, by volume, the most active ransomware group globally before an international law enforcement takedown in February 2024.
LockBit ran an affiliate model that let independent criminal groups use its ransomware in exchange for a cut of ransom payments, which let it scale to claim over 2,000 victims and extort more than $120 million. In February 2024, the FBI, UK's National Crime Agency, Europol, and international partners executed Operation Cronos, seizing LockBit's servers, leak site, and source code, and deliberately eroding trust between LockBit and its roughly 200 affiliates. Attacks attributed to LockBit dropped sharply afterward, though the ransomware-as-a-service model it popularized continues through successor groups.
Target Sectors
Manufacturing, healthcare, financial services, public sector, and professional services, largely indiscriminate by industry.