LockBit V3.0 Ransomware

By /
  • 159/2022
  • High

Lockbit ransomware operation has released LockBit 3.0, which introduces bugbounty programs, and new tactics and techniques. LockBit is known to target the financial services sector heavily among other sectors.

The authors of LockBit 3.0 have introduced new management features for affiliates and added Zcash for victim payments in addition to Monero and Bitcoin.

Lockbit is a ransomware written in C language that encrypts files stored locally and on network shares. Lockbit can also identify additional systems on a network and propagate via SMB.

The updated LockBit payloads retain all the prior functionality of LockBit 2.0.

  • The initial delivery of the Lockbit ransomware relies on social engineering attacks or via 3rd party frameworks such as Cobalt Strike.
  • Lockbit’s payloads will initiate a UAC bypass in case the execution doesn’t succeed with administrative privileges.
  • Lockbit 3.0 persists on target hosts by installing system services. The following service names is associated with Lockbit 3.0: (SecurityHealthService, Sense, Sppsvc ,WdBoot ,WdFilter, WdNisDrv, WdNisSvc, WinDefend, Wscsvc, vmicvss, vmvss, VSS, EventLog)
  • LockBit 3.0 deletes a few services to encrypt files and enumerates and deletes the Volume Shadow copies before the encryption to prevent attempts to restore the file system after the files are encrypted.
  • As with previous versions, LockBit 3.0 will attempt to identify and terminate specific services if found. The following services names are targeted for termination by Lockbit 3.0: (Backup, GxBlr, GxCIMgr, GxCVD, GxFWD, GxVss, memtas, mepocs, msexchange, Sophos, SQL, svc$, veeam, VSS).
  • LockBit 3.0 writes a copy of itself to the %programdata% directory, and subsequently launches from this process.
  • The encryption phase is extremely rapid as the ransomware creates various threads to perform parallel tasks.
  • LockBit 3.0 replaces the name of the file and its extension with random dynamic and static strings.
  • Lockbit 3.0 anti-analysis techniques include code packing, obfuscation and
    dynamic resolution of function addresses, function trampolines, and antidebugging techniques.
  • LockBit 3.0 payloads require a specific passphrase to execute. This passphrase is unique to each sample or campaign.
Mitigations
  • Enable machine learning, active adversary mitigations, and behavioral detection
    in endpoint security.
  • If remote access is required, use a VPN with vendor best-practices multi-factor authentication, password audits, and precise access control, in addition to actively monitoring remote accesses.
  • Users logged into remote access services should have limited privileges for the rest of the corporate network.
  • Administrators should adopt multi-factor authentication and use a separate administrative account from their normal operational account.
  • Develop and implement a patching policy and baseline configuration standards for the operating system.
  • Conduct cybersecurity awareness training for End- users.
  • Search for existing signs of the indicated IoCs in your environment.
  • Block all URL and IP-based IoCs at the organization’s security devices.
  • Ensure anti-virus software and associated files are up to date.
  • Setup an alert on events when the AV agent loses the connection with the main panel.
  • Backup your data using different backup destinations including Tape drives.

References