Threat Intelligence Report April 1 - April 7 2025

LockBit3.0 Ransomware Group

LockBit3.0 continues to assert its dominance as one of the most prolific ransomware operations globally. Operating under the Ransomware-as-a-Service (RaaS) model, LockBit enables affiliates to launch attacks using the group’s advanced encryption tools and infrastructure, allowing it to scale rapidly and efficiently. The group has been linked to nearly one-third of global ransomware attacks, with some estimates attributing 40% of all ransomware incidents to its affiliates.

A distinguishing feature of LockBit’s ecosystem includes a professional dark web portal, a victim leak site, and the only known ransomware-affiliated bug bounty program. The threat actors behind LockBit have iterated their malware through multiple versions — LockBit Red (2.0), and LockBit Black (3.0), and are now testing encryptors for macOS, Linux, and even rare architectures like SPARC and MIPS.

Attack Chain Analysis

Initial Access
LockBit affiliates typically gain entry via compromised credentials from phishing, unpatched software, or brute-forcing RDP/VPN services. Reconnaissance and exploitation are automated using off-the-shelf tools or custom scripts.

Lateral Movement
After gaining a foothold, attackers use native Windows utilities like PsExec, WMI, and RDP to pivot across systems. Access tokens and credentials are harvested using tools such as Mimikatz.

Execution
The payload often includes PowerShell stagers or obfuscated binary droppers. Recent variants also utilise Safe Mode Boot execution and command-line parameters for stealth operations.

Defence Evasion
LockBit employs multiple evasion tactics:

• Encrypted payloads
• Process hollowing
• Use of signed binaries (LOLBAS)
• Environment-aware checks to avoid sandboxes
  
  

Data Exfiltration and Impact
Data is exfiltrated via C2 infrastructure or secure cloud storage before encryption. Upon failure to pay, victims’ data is posted on LockBit’s leak portals hosted on the Tor network.

Detailed TTPs

Mitigations Against LockBit Ransomware

• Harden External Interfaces
  Disable or strictly limit RDP and VPN exposure. Enforce strong passwords and MFA on all remote access points.
• Patch Management
  Regularly update software and operating systems to close known vulnerabilities, particularly those exploited in privilege escalation or lateral movement.
• Network Segmentation
  Implement VLANs or zero-trust architectures to limit lateral movement. Isolate backup systems entirely.
• Application Whitelisting & EDR/XDR
  Deploy next-gen AV/EDR solutions with behaviour-based detections. Use tools like AppLocker or WDAC to block unauthorised executables.
• Credential Protection
  Prevent credential theft by enforcing LSASS protections, disabling legacy protocols (e.g., SMBv1), and rotating domain admin passwords.

Ransomware Victims Worldwide

A recent ransomware threat landscape analysis reveals that the United States remains the most significantly impacted nation, accounting for a substantial 48.85% of global incidents. This highlights the persistent targeting of US-based organisations by increasingly sophisticated ransomware operations.

Germany emerges as the second-most affected country, reporting 10.34% of global incidents, followed by Canada at 6.9%, and the United Kingdom at 4.6%. These figures signal an intensifying focus on key Western economies. Meanwhile, India reports 3.45% of global cases, demonstrating the spread of ransomware campaigns into South Asia.

Several other countries have experienced moderate levels of ransomware activity, including Italy (2.3%), Bangladesh (1.72%), France (1.72%), Australia (1.72%), Spain (1.72%), and the United Arab Emirates (1.72%), reflecting a broader geographic distribution of ransomware attacks across Europe, Asia, and the Middle East.

Nations reporting 1.15% of incidents each include Brazil, Saudi Arabia, Taiwan, and Singapore — suggesting that even technologically advanced or geographically distant countries are not immune to these threats.

Several countries recorded lower yet notable percentages of ransomware activity, each contributing 0.57% of global incidents. These include the Netherlands, Austria, China, Israel, Colombia, Indonesia, Argentina, Japan, Ireland, Switzerland, Sweden, Egypt, Iran, Ukraine, New Zealand, Greece, and Turkey.

This global distribution of ransomware incidents underscores the widening scope and international scale of cybercriminal operations. The findings highlight the urgent need for coordinated cybersecurity efforts, including cross-border intelligence sharing, robust threat detection capabilities, and resilient incident response plans to mitigate the escalating risk posed by ransomware threats.