Ransomware Group intelligence
Lockbit3_fs
ActiveTrack Lockbit3_fs with 0 published victims and 40 known leak locations in a single intelligence view.
BREACH HOUSE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
Lockbit3_fs is tracked by Breach House as a ransomware group with 0 published victims.
The group is tracked across multiple victim records in the Breach House dataset.
40 known leak locations are currently associated with this group.
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (40)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 23 | Onion service | Up checked 8h ago | lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion |
| Leak location 24 | Onion service | Up checked 8h ago | lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion |
| Leak location 21 | Onion service | Up checked 8h ago | lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion |
| Leak location 20 | Onion service | Up checked 8h ago | lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion |
| Leak location 18 | Onion service | Up checked 8h ago | lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion |
| Leak location 17 | Onion service | Up checked 8h ago | lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion |
| Leak location 14 | Onion service | Up checked 8h ago | lockbit7z4ndl6thsct34yd47jrzdkpnfg3acfvpacuccb45pnars2ad.onion |
| Leak location 15 | Onion service | Up checked 8h ago | lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion |
| Leak location 40 | Onion service | Up checked 8h ago | lockbit7z4ndl6thsct34yd47jrzdkpnfg3acfvpacuccb45pnars2ad.onion |
| Leak location 13 | Onion service | Up checked 8h ago | lockbit7z4k5zer5fbqi2vdq5sx2vuggatwyqvoodrkhubxftyrvncid.onion |
| Leak location 39 | Onion service | Up checked 8h ago | lockbit7z4k5zer5fbqi2vdq5sx2vuggatwyqvoodrkhubxftyrvncid.onion |
| Leak location 10 | Onion service | Up checked 8h ago | lockbit7z3ujnkhxwahhjduh5me2updvzxewhhc5qvk2snxezoi5drad.onion |
| Leak location 36 | Onion service | Up checked 8h ago | lockbit7z3ujnkhxwahhjduh5me2updvzxewhhc5qvk2snxezoi5drad.onion |
| Leak location 9 | Onion service | Up checked 8h ago | lockbit7z3hv7ev5knxbrhsvv2mmu2rddwqizdz4vwfvxt5izrq6zqqd.onion |
| Leak location 35 | Onion service | Up checked 8h ago | lockbit7z3hv7ev5knxbrhsvv2mmu2rddwqizdz4vwfvxt5izrq6zqqd.onion |
| Leak location 12 | Onion service | Up checked 8h ago | lockbit7z4cgxvictidwfxpuiov4scdw34nxotmbdjyxpkvkg34mykyd.onion |
| Leak location 38 | Onion service | Up checked 8h ago | lockbit7z4cgxvictidwfxpuiov4scdw34nxotmbdjyxpkvkg34mykyd.onion |
| Leak location 11 | Onion service | Up checked 8h ago | lockbit7z4bsm63m3dagp5xglyacr4z4bwytkvkkwtn6enmuo5fi5iyd.onion |
| Leak location 37 | Onion service | Up checked 8h ago | lockbit7z4bsm63m3dagp5xglyacr4z4bwytkvkkwtn6enmuo5fi5iyd.onion |
| Leak location 6 | Onion service | Up checked 8h ago | lockbit7z37ntefjdbjextn6tmdkry4j546ejnru5cejeguitiopvhad.onion |
| Leak location 32 | Onion service | Up checked 8h ago | lockbit7z37ntefjdbjextn6tmdkry4j546ejnru5cejeguitiopvhad.onion |
| Leak location 7 | Onion service | Up checked 8h ago | lockbit7z3azdoxdpqxzliszutufbc2fldagztdu47xyucp25p4xtqad.onion |
| Leak location 33 | Onion service | Up checked 8h ago | lockbit7z3azdoxdpqxzliszutufbc2fldagztdu47xyucp25p4xtqad.onion |
| Leak location 3 | Onion service | Up checked 8h ago | lockbit7z2og4jlsmdy7dzty3g42eu3gh2sx2b6ywtvhrjtss7li4fyd.onion |
| Leak location 8 | Onion service | Up checked 8h ago | lockbit7z3ddvg5vuez2vznt73ljqgwx5tnuqaa2ye7lns742yiv2zyd.onion |
| Leak location 29 | Onion service | Up checked 8h ago | lockbit7z2og4jlsmdy7dzty3g42eu3gh2sx2b6ywtvhrjtss7li4fyd.onion |
| Leak location 34 | Onion service | Up checked 8h ago | lockbit7z3ddvg5vuez2vznt73ljqgwx5tnuqaa2ye7lns742yiv2zyd.onion |
| Leak location 4 | Onion service | Up checked 8h ago | lockbit7z355oalq4hiy5p7de64l6rsqutwlvydqje56uvevcc57r6qd.onion |
| Leak location 30 | Onion service | Up checked 8h ago | lockbit7z355oalq4hiy5p7de64l6rsqutwlvydqje56uvevcc57r6qd.onion |
| Leak location 5 | Onion service | Up checked 8h ago | lockbit7z36ynytxwjzuoao46ck7b3753gpedary3qvuizn3iczhe4id.onion |
| Leak location 31 | Onion service | Up checked 8h ago | lockbit7z36ynytxwjzuoao46ck7b3753gpedary3qvuizn3iczhe4id.onion |
| Leak location 1 | Onion service | Up checked 8h ago | lockbit7z2jwcskxpbokpemdxmltipntwlkmidcll2qirbu7ykg46eyd.onion |
| Leak location 27 | Onion service | Up checked 8h ago | lockbit7z2jwcskxpbokpemdxmltipntwlkmidcll2qirbu7ykg46eyd.onion |
| Leak location 2 | Onion service | Up checked 8h ago | lockbit7z2mmiz3ryxafn5kapbvbbiywsxwovasfkgf5dqqp5kxlajad.onion |
| Leak location 28 | Onion service | Up checked 8h ago | lockbit7z2mmiz3ryxafn5kapbvbbiywsxwovasfkgf5dqqp5kxlajad.onion |
| Leak location 26 | Onion service | Down checked 8h ago | lockbitnotexk2vnf2q2zwjefsl3hjsnk4u74vq4chxrqpjclfydk4ad.onion |
| Leak location 16 | Onion service | Down checked 8h ago | lockbit7z57mkicfkuq44j6yrpu5finwvjllczkkp2uvdedsdonjztyd.onion |
| Leak location 25 | Onion service | Down checked 8h ago | lockbitfile2tcudkcqqt2ve6btssyvqwlizbpv5vz337lslmhff2uad.onion |
| Leak location 22 | Onion service | Down checked 8h ago | lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion |
| Leak location 19 | Onion service | Down checked 8h ago | lockbit7z5ltrhzv46lsg447o3cx2637dloc3qt4ugd3gr2xdkkkeayd.onion |
Top Activity Sectors
No sector intelligence available.
Typical Attacks (34)
▼How Lockbit3_fs typically operates, as attributed by MITRE ATT&CK v19.2. Attributed via LockBit 3.0.
-
What they do: LockBit 3.0 can use a compromised local account for lateral movement.
What that means: Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
-
T1059.001 PowerShell Execution
What they do: LockBit 3.0 can use PowerShell to apply Group Policy changes.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
T1106 Native API Execution
What they do: LockBit 3.0 has the ability to directly call native Windows API items during execution.
What that means: Adversaries may interact with the native OS application programming interface (API) to execute behaviors.
-
T1569.002 Service Execution Execution
What they do: LockBit 3.0 can use PsExec to execute commands and payloads.
What that means: Adversaries may abuse the Windows service control manager to execute malicious commands or payloads.
-
What they do: LockBit 3.0 can change the Registry values for Group Policy refresh time, to disable SmartScreen, and to disable Windows Defender.
What that means: Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.
-
What they do: LockBit 3.0 can install system services for persistence.
What that means: Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence.
-
What they do: LockBit 3.0 can enable automatic logon through the `SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon` Registry key.
What that means: Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in.
-
What they do: LockBit 3.0 can enable options for propogation through Group Policy Objects.
What that means: Adversaries may modify Group Policy Objects (GPOs) to subvert the intended discretionary access controls for a domain, usually with the intention of escalating privileges on the domain.
-
T1548.002 Bypass User Account Control Privilege Escalation
What they do: LockBit 3.0 can bypass UAC to execute code with elevated privileges through an elevated Component Object Model (COM) interface.
What that means: Adversaries may bypass UAC mechanisms to elevate process privileges on system.
-
T1027.002 Software Packing Stealth
What they do: LockBit 3.0 can use code packing to hinder analysis.
What that means: Adversaries may perform software packing or virtual machine software protection to conceal their code.
-
T1027.013 Encrypted/Encoded File Stealth
What they do: The LockBit 3.0 payload includes an encrypted main component.
What that means: Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection.
-
T1070.004 File Deletion Stealth
What they do: LockBit 3.0 can delete itself from disk.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1140 Deobfuscate/Decode Files or Information Stealth
What they do: The LockBit 3.0 payload is decrypted at runtime.
What that means: Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis.
-
T1218.003 CMSTP Stealth
What they do: LockBit 3.0 can attempt a CMSTP UAC bypass if it does not have administrative privileges.
What that means: Adversaries may abuse CMSTP to proxy execution of malicious code.
-
T1480 Execution Guardrails Stealth
What they do: LockBit 3.0 can make execution dependent on specific parameters including a unique passphrase and the system language of the targeted host not being found on a set exclusion list.
What that means: Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target.
-
T1480.002 Mutual Exclusion Stealth
What they do: LockBit 3.0 can create and check for a mutex containing a hash of the `MachineGUID` value at execution to prevent running more than one instance.
What that means: Adversaries may constrain execution or actions based on the presence of a mutex associated with malware.
-
What they do: LockBit 3.0 can check heap memory parameters for indications of a debugger and stop the flow of events to the attached debugger in order to hinder dynamic analysis.
What that means: Adversaries may employ various means to detect and avoid debuggers.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: LockBit 3.0 can disable security tools to evade detection including Windows Defender.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1685.005 Clear Windows Event Logs Defense Impairment
What they do: LockBit 3.0 can delete log files on targeted systems.
What that means: Adversaries may clear Windows Event Logs to hide the activity of an intrusion.
-
T1688 Safe Mode Boot Defense Impairment
What they do: LockBit 3.0 can reboot the infected host into Safe Mode.
What that means: Adversaries may abuse Windows safe mode to disable endpoint defenses.
-
T1057 Process Discovery Discovery
What they do: LockBit 3.0 can identify and terminate specific services.
What that means: Adversaries may attempt to get information about running processes on a system.
-
T1082 System Information Discovery Discovery
What they do: LockBit 3.0 can enumerate system hostname and domain.
What that means: An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.
-
T1083 File and Directory Discovery Discovery
What they do: LockBit 3.0 can exclude files associated with core system functions from encryption.
What that means: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
-
T1120 Peripheral Device Discovery Discovery
What they do: LockBit 3.0 has the ability to discover external storage devices.
What that means: Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.
-
T1135 Network Share Discovery Discovery
What they do: LockBit 3.0 can identify network shares on compromised systems.
What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
-
T1614.001 System Language Discovery Discovery
What they do: LockBit 3.0 will not affect machines with language settings matching a defined exlusion list of mainly Eastern European languages.
What that means: Adversaries may attempt to gather information about the system language of a victim in order to infer the geographical location of that host.
-
T1680 Local Storage Discovery Discovery
What they do: LockBit 3.0 can enumerate local drive configuration.
What that means: Adversaries may enumerate local drives, disks, and/or volumes and their attributes like total or free space and volume serial number.
-
T1021.002 SMB/Windows Admin Shares Lateral Movement
What they do: LockBit 3.0 can use SMB for lateral movement.
What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
-
T1071.001 Web Protocols Command and Control
What they do: LockBit 3.0 can use HTTP to send victim host information to C2.
What that means: Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic.
-
T1132.001 Standard Encoding Command and Control
What they do: LockBit 3.0 can Base64-encode C2 communication.
What that means: Adversaries may encode data with a standard data encoding system to make the content of command and control traffic more difficult to detect.
-
T1573.001 Symmetric Cryptography Command and Control
What they do: LockBit 3.0 can encrypt C2 communications with AES.
What that means: Adversaries may employ a known symmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol.
-
T1486 Data Encrypted for Impact Impact
What they do: LockBit 3.0 can encrypt targeted data using the AES-256, ChaCha20, or RSA-2048 algorithms.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1489 Service Stop Impact
What they do: LockBit 3.0 can terminate targeted processes and services related to security, backup, database management, and other applications that could stop or interfere with encryption.
What that means: Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.
-
T1490 Inhibit System Recovery Impact
What they do: LockBit 3.0 can delete volume shadow copies.
What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
Victims (0)
Search, filter and paginate the victim timeline for Lockbit3_fs.
| Type | Target | Discovered | Country | Business Category | Intel Link |
|---|
No victims found for the selected filters.