On March 16th, 2023, CISA, FBI and MS-ISAC released a joint advisory on LockBit 3.0 ransomware as part of #StopRansomware effort. LockBit 3.0, also known as LockBit Black, operates a Ransomware-as-a-Service (RaaS) service and employs a double-extortion tactic to get victims to pay ransom.Why is this Significant?This is significant because organizations hit by ransomware are likely to suffer from and not limited to – operational downtime, damaged reputation, heavy cost of time and manpower due recovery effort, and exposure of stolen data. AA23-075A is the latest #StopRansomware joint advisory released by the Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), the Multi-State Information Sharing & Analysis Center (MS-ISAC), which provides observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations protect against LockBit 3.0 ransomware.What is LockBit 3.0?LockBit 3.0 is a ransomware variant that is a successor to LockBit and LockBit 2.0 ransomware which was released in mid-2022. The ransomware operates as Ransomware-as-a-Service (RaaS) and employs a double-extortion tactic that demands victims pay ransom to recover affected files and not have stolen information leaked to the public.As a ransomware, LockBit 3.0 encrypts files on compromised machines. Prior to the file encryption routine, attackers exfiltrate information using custom and dual-use tools such as Stealbit and rclone, and publicly available file sharing services. The ransomware also drops a ransom note labeled [Ransomware ID].README.txt. Furthermore, LockBit 3.0 deletes shadow copies to prevent file recovery and replaces desktop wallpaper with its own. The ransomware stops its operation if a compromised machine’s language setting is set to predefined languages such as Russian, Armenian, Belarusian, Georgian and Ukrainian. Example of LockBit 3.0 ransomware’s ransom noteWhat is the Status of Protection?FortiGuard Labs has the following AV signatures in place for LockBit 3.0 samples known to us:W32/Lockbit.K!tr.ransomW32/Filecoder_Lockbit.H!trW32/BlackMatter.D!trW32/BlackMatter.E!tr.ransomW32/BlackMatter.K!tr.ransomW32/BlackMatter.O!tr.ransomW32/Filecoder_BlackMatter.D!trW32/Filecoder_BlackMatter.D!tr.ransomW32/Filecoder_BlackMatter.E!trW32/Filecoder_BlackMatter.E!tr.ransomW32/AZG!tr.ransomNSIS/Injector.AOW!trW32/PossibleThreat
More Stories
DSA-5688-1 atril – security update
It was discovered that missing input sanitising in the Atril document viewer could result in writing arbitrary files in the...
chromium-124.0.6367.201-1.el9
FEDORA-EPEL-2024-6f1c3198f5 Packages in this update: chromium-124.0.6367.201-1.el9 Update description: update to 124.0.6367.201 * High CVE-2024-4671: Use after free in Visuals update...