Vietnam Newsroom & Threat Intelligence
Clear sources · Careful assessments
Ransomware.VN
NOTEDo not attribute a ransomware family from a file extension or a single ransom note.Vietnam time · UTC+7
Home/Ransomware families/LockBit
Technical profile

LockBit

A ransomware family with activity and TTP profiles published by CISA and partner agencies.

Confirmed (Confirmed) · Reference profile status, not attribution for an individual case.

Name / status
LockBit · Confirmed
Aliases
LockBit 2.0 / LockBit Red; version names require separate comparison.
First seen
CISA documentation describes activity since 2020.
Target platforms
Check individual variants in the advisory; do not assume every platform is affected.
TTP
CISA describes multiple behaviors of LockBit operators; compare by event and version.
Current Activity
No verified current activity dataset is available in this profile.
Target sectors
Sector categories have not been standardized in V1.
MITRE ATT&CK
Compare techniques against the reference sources; see the TTP Map.
IOC
Use only sourced, contextualized indicators; see IOC Watch.
Extension
Varies by variant; not sufficient as sole evidence.
Ransom note
No reference ransom note has been added to this profile.
Encryption behavior
Analyze the correct sample and version.
Partial / Full / Chunked
No separate measurements on a representative sample.
Public decryptor status
Insufficient data
Recovery Intelligence
No validated recovery observations support generalization to all variants.
Leak site
Leak-site claims are not independent evidence. Direct links are not published.
Known incidents
No separately verified incident list has been added to this profile.
Detection notes
Compare multiple evidence sources; distinguish a single indicator from a conclusion about the entire incident.
Recovery notes
Assess samples and data structures. A family name alone does not establish recovery prospects.
Last updated
09/10/2026 (UTC+7)
CISA — Understanding Ransomware Threat Actors: LockBit14/06/2023 · Observed activity and defensive recommendations.

Each source's scope and date are recorded separately when available. A citation does not independently verify every assessment.

09/10/2026 · Added recovery scope, decryptor status and tool links; marked fields with insufficient data.

04/10/2026 · Created the reference profile and clearly marked missing data.