Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · lockbit · Crime · ransomware.live · refreshed 2026-10-06

lockbit

sigil · no ATT&CK coverage stated

What changed

ledger · newest first
  1. —todaynew CVE2 new CVEs: CVE-2018-13379, CVE-2023-4966
  2. —1 mo agoresurfacedback on the wire after 21 quiet days
  3. —1 mo agonew CVE1 new CVE: CVE-2023-46604

Analyst brief

ransomware.live

LockBit is one of the most prolific ransomware groups in history, operating as a full RaaS platform that at its peak accounted for an estimated 44% of all ransomware incidents globally in 2023, targeting virtually every sector worldwide through an affiliate model where developers maintain infrastructure and affiliates conduct intrusions.

CVEs lockbit is cited as exploiting

1 on CISA KEV
  1. CVE-2023-49662026-10-17
    1. “associated with LockBit 3.0 ransomware exploiting CVE-2023-4966, labeled Citrix Bleed”

      cited as exploiting · source: ics-cert.kaspersky.com ↗ · 2026-10-17

  2. CVE-2018-133792026-10-17
    1. “LockBit affiliates gain access via compromised servers, or by using RDP or VPN accounts using brute force insecure credentials. A further delivery method is by exploiting Fortinet VPN CVE-2018-13379 vulnerability.”

      cited as exploiting · source: security.packt.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Named alongside lockbit only

CVEs named in the same dispatches as lockbit
CVEStatusEPSS
CVE-2023-46604Actively exploited100%

These CVEs appeared in the same dispatches as lockbit. That is an association in reporting, not a claim that this group used them — read the dispatch, then the vendor advisory, before you treat it as either.

Take it with you

keyless · no signup

References

1 source
  1. 1.ransomware.live

Track lockbit on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.