LockBit 3.0
Software · ATTACK:enterprise:S1202
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S1202",
"title": "LockBit 3.0",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S1202",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--71fe9df1-1c6f-430c-ab9b-ff3c11074e52",
"external_id": "S1202",
"domain": "enterprise",
"created": "2025-02-05T21:28:23.240Z",
"modified": "2025-10-21T23:34:46.898Z",
"version": "1.1",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "LockBit Black"
},
{
"source_name": "Joint Cybersecurity Advisory LockBit JUN 2023",
"url": "https://www.cisa.gov/sites/default/files/2023-06/aa23-165a_understanding_TA_LockBit_0.pdf"
},
{
"source_name": "Joint Cybersecurity Advisory LockBit 3.0 MAR 2023",
"url": "https://www.cisa.gov/sites/default/files/2023-03/aa23-075a-stop-ransomware-lockbit.pdf"
},
{
"source_name": "INCIBE-CERT LockBit MAR 2024",
"url": "https://www.incibe.es/en/incibe-cert/blog/lockbit-response-and-recovery-actions"
},
{
"source_name": "Sentinel Labs LockBit 3.0 JUL 2022",
"url": "https://www.sentinelone.com/labs/lockbit-3-0-update-unpicking-the-ransomwares-latest-anti-analysis-and-evasion-techniques"
}
]
}Explicit source assertions (34)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S1202 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0805f7ac-0596-4154-bf56-8eb0ee5cc635
Joint Cybersecurity Advisory LockBit 3.0 MAR 2023 · INCIBE-CERT LockBit MAR 2024 · Sentinel Labs LockBit 3.0 JUL 2022ATTACK:enterprise:S1202 → uses → ATTACK:enterprise:T1573.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0ef68afe-92bf-48f6-800c-f20431abdd7e
Joint Cybersecurity Advisory LockBit 3.0 MAR 2023ATTACK:enterprise:S1202 → uses → ATTACK:enterprise:T1548.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0f5eaa9c-9252-48a7-a386-cc05e3ceaed5
Joint Cybersecurity Advisory LockBit 3.0 MAR 2023ATTACK:enterprise:S1202 → uses → ATTACK:enterprise:T1484.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--12496398-56f0-4db2-aba7-6ded41768853
Joint Cybersecurity Advisory LockBit 3.0 MAR 2023ATTACK:enterprise:S1202 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1ad06cf0-26dd-4020-b57b-f26e83ae1875
Joint Cybersecurity Advisory LockBit 3.0 MAR 2023ATTACK:enterprise:S1202 → uses → ATTACK:enterprise:T1112
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1c4a31d0-3567-4081-93f5-14de47eabecf
Joint Cybersecurity Advisory LockBit 3.0 MAR 2023 · INCIBE-CERT LockBit MAR 2024ATTACK:enterprise:S1202 → uses → ATTACK:enterprise:T1480.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2602353f-7337-4fee-8dd4-dee77cb6bbd0
Joint Cybersecurity Advisory LockBit 3.0 MAR 2023ATTACK:enterprise:S1202 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2f17ddd3-40e5-4784-9a5b-eecbfbdd1c15
Joint Cybersecurity Advisory LockBit 3.0 MAR 2023 · Sentinel Labs LockBit 3.0 JUL 2022ATTACK:enterprise:S1202 → uses → ATTACK:enterprise:T1027.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3570d377-9139-4221-9c4b-15147b78e8ad
INCIBE-CERT LockBit MAR 2024 · Sentinel Labs LockBit 3.0 JUL 2022ATTACK:enterprise:S1202 → uses → ATTACK:enterprise:T1680
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--39ef8d48-fb74-412a-8c6d-b889e3fca644
Joint Cybersecurity Advisory LockBit 3.0 MAR 2023ATTACK:enterprise:S1202 → uses → ATTACK:enterprise:T1543.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3cce1055-1e6a-47ba-9468-fb1cea1eb0a3
Sentinel Labs LockBit 3.0 JUL 2022ATTACK:enterprise:S1202 → uses → ATTACK:enterprise:T1569.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3d6d167f-6a45-4e4f-8576-6f7713444acd
Joint Cybersecurity Advisory LockBit JUN 2023ATTACK:enterprise:S1202 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4001de2c-3f75-4a30-8c55-1169b5399af1
Joint Cybersecurity Advisory LockBit 3.0 MAR 2023 · INCIBE-CERT LockBit MAR 2024ATTACK:enterprise:S1202 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4c90355d-1d51-41b1-ad7a-e62537483a90
INCIBE-CERT LockBit MAR 2024 · Sentinel Labs LockBit 3.0 JUL 2022ATTACK:enterprise:S1202 → uses → ATTACK:enterprise:T1480
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--53ae49f4-6cc4-4fb0-b79e-84af1aa136eb
Joint Cybersecurity Advisory LockBit JUN 2023 · Joint Cybersecurity Advisory LockBit 3.0 MAR 2023 · Sentinel Labs LockBit 3.0 JUL 2022ATTACK:enterprise:S1202 → uses → ATTACK:enterprise:T1685.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--563e5c4d-0ff6-44ac-858b-37c2927589f6
Joint Cybersecurity Advisory LockBit JUN 2023 · Joint Cybersecurity Advisory LockBit 3.0 MAR 2023ATTACK:enterprise:S1202 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--570513a9-e131-41ad-92c8-7f8d35ef257a
Joint Cybersecurity Advisory LockBit JUN 2023 · Joint Cybersecurity Advisory LockBit 3.0 MAR 2023ATTACK:enterprise:S1202 → uses → ATTACK:enterprise:T1218.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--59aa96b0-ea78-49f4-87d7-367550846ea0
Sentinel Labs LockBit 3.0 JUL 2022ATTACK:enterprise:S1202 → uses → ATTACK:enterprise:T1685
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5baaca5c-6f5b-4cbf-9bef-2f6625ec9e3f
Joint Cybersecurity Advisory LockBit JUN 2023 · Joint Cybersecurity Advisory LockBit 3.0 MAR 2023 · INCIBE-CERT LockBit MAR 2024ATTACK:enterprise:S1202 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5c5ac8b1-745e-4727-9735-a7d1ff049fb2
Joint Cybersecurity Advisory LockBit 3.0 MAR 2023ATTACK:enterprise:S1202 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9273ab6e-ccee-40ed-8cf1-420cd0650d20
Joint Cybersecurity Advisory LockBit 3.0 MAR 2023ATTACK:enterprise:S1202 → uses → ATTACK:enterprise:T1135
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--98b296c0-467b-4029-a813-0cd94c0a9520
Joint Cybersecurity Advisory LockBit 3.0 MAR 2023ATTACK:enterprise:S1202 → uses → ATTACK:enterprise:T1132.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9ffd30d7-9f2b-45cd-94cb-4ff2be36f84f
Joint Cybersecurity Advisory LockBit 3.0 MAR 2023ATTACK:enterprise:S1202 → uses → ATTACK:enterprise:T1622
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b6e9f75a-6cf1-400a-a282-a43214dfb729
Sentinel Labs LockBit 3.0 JUL 2022ATTACK:enterprise:S1202 → uses → ATTACK:enterprise:T1489
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b90beadd-a65d-4013-a552-8d114c6c7c28
Joint Cybersecurity Advisory LockBit JUN 2023 · Joint Cybersecurity Advisory LockBit 3.0 MAR 2023 · INCIBE-CERT LockBit MAR 2024 · Sentinel Labs LockBit 3.0 JUL 2022ATTACK:enterprise:S1202 → uses → ATTACK:enterprise:T1547.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c3210ee1-934b-44fd-9103-0b7f0f211365
Joint Cybersecurity Advisory LockBit 3.0 MAR 2023ATTACK:enterprise:S1202 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c32cb7ce-20a0-43d9-b600-d44ef0254aa8
Joint Cybersecurity Advisory LockBit JUN 2023 · Sentinel Labs LockBit 3.0 JUL 2022ATTACK:enterprise:S1202 → uses → ATTACK:enterprise:T1614.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cf534a00-489d-4980-b647-e4ff020b96d1
Joint Cybersecurity Advisory LockBit JUN 2023 · Joint Cybersecurity Advisory LockBit 3.0 MAR 2023ATTACK:enterprise:S1202 → uses → ATTACK:enterprise:T1120
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d6280c13-44e7-4046-bb53-a5f97cd25f43
Joint Cybersecurity Advisory LockBit 3.0 MAR 2023ATTACK:enterprise:S1202 → uses → ATTACK:enterprise:T1486
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d96dafc9-c011-4f5b-a823-ff174ab7d345
Joint Cybersecurity Advisory LockBit JUN 2023 · Joint Cybersecurity Advisory LockBit 3.0 MAR 2023 · INCIBE-CERT LockBit MAR 2024 · Sentinel Labs LockBit 3.0 JUL 2022ATTACK:enterprise:S1202 → uses → ATTACK:enterprise:T1021.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e5d1b1c8-e569-4861-8fb1-18765df9092f
Joint Cybersecurity Advisory LockBit 3.0 MAR 2023ATTACK:enterprise:S1202 → uses → ATTACK:enterprise:T1688
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e683db23-0a9e-408f-8197-7d88c52f360a
Joint Cybersecurity Advisory LockBit 3.0 MAR 2023ATTACK:enterprise:S1202 → uses → ATTACK:enterprise:T1078.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e98cd360-3832-4b30-aa06-ad61d1b665ab
Joint Cybersecurity Advisory LockBit 3.0 MAR 2023ATTACK:enterprise:S1202 → uses → ATTACK:enterprise:T1490
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f074afef-4b9a-474e-b5fd-21143a927d83
Joint Cybersecurity Advisory LockBit JUN 2023 · Joint Cybersecurity Advisory LockBit 3.0 MAR 2023 · INCIBE-CERT LockBit MAR 2024