Skip to content

LockBit 2.0

Software · ATTACK:enterprise:S1199

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:S1199",
  "title": "LockBit 2.0",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S1199",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--a4578560-42cf-4075-9fa2-056f0058c881",
  "external_id": "S1199",
  "domain": "enterprise",
  "created": "2025-01-24T22:09:44.468Z",
  "modified": "2025-10-21T17:57:24.341Z",
  "version": "1.1",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Palo Alto Lockbit 2.0 JUN 2022",
      "url": "https://unit42.paloaltonetworks.com/lockbit-2-ransomware/"
    },
    {
      "source_name": "FBI Lockbit 2.0 FEB 2022",
      "url": "https://www.ic3.gov/CSA/2022/220204.pdf"
    }
  ]
}

Explicit source assertions (26)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S1199 → uses → ATTACK:enterprise:T1564.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--133a678e-66cc-4d28-b768-a8f7c6fcd753

Palo Alto Lockbit 2.0 JUN 2022

ATTACK:enterprise:S1199 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1400cd29-916f-40fe-af7c-ec89ef7b75c8

FBI Lockbit 2.0 FEB 2022

ATTACK:enterprise:S1199 → uses → ATTACK:enterprise:T1053.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1dfccb9f-6a8e-46fb-8a0b-d1b0568da2ed

Palo Alto Lockbit 2.0 JUN 2022

ATTACK:enterprise:S1199 → uses → ATTACK:enterprise:T1059.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2a42bba4-1bb8-4119-9d55-80d0d37d6313

Cybereason Lockbit 2.0 · Palo Alto Lockbit 2.0 JUN 2022 · FBI Lockbit 2.0 FEB 2022

ATTACK:enterprise:S1199 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--36f687d3-8052-4009-836d-8b796a1fcf71

Palo Alto Lockbit 2.0 JUN 2022 · FBI Lockbit 2.0 FEB 2022

ATTACK:enterprise:S1199 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--43e15d3b-02ef-4e6c-97f7-a62db9de2e3a

SentinelOne LockBit 2.0

ATTACK:enterprise:S1199 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--46393d52-ee2f-44d6-bad6-37a75344f5d2

Palo Alto Lockbit 2.0 JUN 2022 · FBI Lockbit 2.0 FEB 2022

ATTACK:enterprise:S1199 → uses → ATTACK:enterprise:T1136

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4b701171-23cd-41b0-9bde-3a1dfc236161

Palo Alto Lockbit 2.0 JUN 2022

ATTACK:enterprise:S1199 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5cb4493b-1830-436a-8c1b-5aab2ef37442

FBI Lockbit 2.0 FEB 2022

ATTACK:enterprise:S1199 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--65f3f758-ac69-4f7a-b56e-6bbafddae619

Palo Alto Lockbit 2.0 JUN 2022 · FBI Lockbit 2.0 FEB 2022

ATTACK:enterprise:S1199 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--74efbb05-7272-4cf4-9fa7-5720e8bfe26d

Palo Alto Lockbit 2.0 JUN 2022 · FBI Lockbit 2.0 FEB 2022

ATTACK:enterprise:S1199 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--767f436a-6979-456b-8d2d-b8c8a6b86446

FBI Lockbit 2.0 FEB 2022 · SentinelOne LockBit 2.0

ATTACK:enterprise:S1199 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--784e4454-00c9-482e-a8a8-d5db7b034d3c

FBI Lockbit 2.0 FEB 2022

ATTACK:enterprise:S1199 → uses → ATTACK:enterprise:T1484.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--78ecd98e-4235-4672-9e07-834c39542b6d

Palo Alto Lockbit 2.0 JUN 2022 · FBI Lockbit 2.0 FEB 2022

ATTACK:enterprise:S1199 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7aac169b-e8ff-47fe-8649-ea09929c6605

FBI Lockbit 2.0 FEB 2022

ATTACK:enterprise:S1199 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8129042e-5e4b-412b-bbb7-a127312abf25

FBI Lockbit 2.0 FEB 2022

ATTACK:enterprise:S1199 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--83b9dc24-fc85-40dd-ad6e-f8eeededc53f

Palo Alto Lockbit 2.0 JUN 2022 · FBI Lockbit 2.0 FEB 2022

ATTACK:enterprise:S1199 → uses → ATTACK:enterprise:T1685.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8bfd8a04-63b1-4c2f-a6ba-adc67ab87154

Cybereason Lockbit 2.0 · Palo Alto Lockbit 2.0 JUN 2022 · FBI Lockbit 2.0 FEB 2022 · SentinelOne LockBit 2.0

ATTACK:enterprise:S1199 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a0419eb3-f257-4b1a-8577-600b7105e318

Cybereason Lockbit 2.0

ATTACK:enterprise:S1199 → uses → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ad02f6c8-9b1c-4d94-b6fd-fb953b9f8048

Palo Alto Lockbit 2.0 JUN 2022 · FBI Lockbit 2.0 FEB 2022

ATTACK:enterprise:S1199 → uses → ATTACK:enterprise:T1614.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b4e02911-e7de-4561-a20d-56ddfd7eab44

Palo Alto Lockbit 2.0 JUN 2022 · FBI Lockbit 2.0 FEB 2022

ATTACK:enterprise:S1199 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--be7d0718-28e5-4f49-9636-c5deafa63530

Cybereason Lockbit 2.0 · Palo Alto Lockbit 2.0 JUN 2022 · FBI Lockbit 2.0 FEB 2022

ATTACK:enterprise:S1199 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c8b6114c-df7f-4e19-ae9f-6cde01c46b04

Palo Alto Lockbit 2.0 JUN 2022 · SentinelOne LockBit 2.0

ATTACK:enterprise:S1199 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d9701e96-5901-4e81-95d8-8938bbff9566

Palo Alto Lockbit 2.0 JUN 2022 · SentinelOne LockBit 2.0

ATTACK:enterprise:S1199 → uses → ATTACK:enterprise:T1059.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e3534937-b68c-47d3-9ebd-b9fff381528c

Palo Alto Lockbit 2.0 JUN 2022 · FBI Lockbit 2.0 FEB 2022

ATTACK:enterprise:S1199 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fd1a359c-c834-4368-915c-bd278e179d5c

Cybereason Lockbit 2.0 · FBI Lockbit 2.0 FEB 2022

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.