Day 5: lockbit Ransomware

LockBit typically utilizes email phishing to gain initial network access, but may also enter via application exploits or unpatched vulnerabilities. Once the threat actor places the malware, it begins to automatically self-propagate per its intended design. After one host is infected, the ransomware can locate additional connected hosts and extend the infection with a unique script.

What makes LockBit difficult to identify is that its encryption file is sometimes disguised as .PNG and it spreads using tools common in computers with Windows Operating Systems, such as PowerShell and Server Message Block (SMB). LockBit exploits CVE-2018-13379 to access valid VPN accounts by adding a code to the URL: /remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession.

LockBit ransomware uses its own data-stealing tool called StealBit. They also have been known for self-propagation and printing out ransom notes on printers.