LockBit Recovery (2.0, 3.0/Black and variants)
Direct answer
LockBit was the most prolific ransomware family between 2021 and 2024, with versions 2.0, 3.0 (Black) and Green. In February 2024, Operation Cronos (NCA/FBI) seized infrastructure and released part of the keys. Derivative variants remain active in 2026. HD Doctor runs technical response: containment, compromise forensics, public decryptor attempt when eligible, and backup or VM restore, with documented chain of custody for forensic reports.
Do not pay the ransom before a technical analysis. In many LockBit 3.0/Black cases there is a partial decryption possibility via Cronos keys. Payment does not guarantee recovery and may breach OFAC sanctions.
What is LockBit
LockBit is a Ransomware-as-a-Service (RaaS) family operated by a Russia-linked group, active since 2019. It evolved through LockBit 1.0, 2.0 (Red), 3.0 (Black) and Green. Uses AES-256 + RSA-2048 and appends a variable extension to files (.lockbit, .HLJkNskOq, [random].README.txt). Notable trait: drops a note with a Tor link and a short payment deadline, with progressive leak on a darknet site. Operation Cronos (Feb 2024) seized domains and part of the infrastructure.
Symptoms of LockBit infection
- Files with extension .lockbit, .HLJkNskOq or 9-char random + .README.txt
- Note 'Restore-My-Files.txt' or '[ID].README.txt' in each folder
- Wallpaper changed to black background with LockBit icon
- AD logs showing Mimikatz, PsExec, Cobalt Strike Beacon
- Volume Shadow Copies deleted via vssadmin
- Hyper-V/ESXi VMs powered off and VMDK/VHDX encrypted
Most common attack vectors
| Cause | % | Recoverable? |
|---|---|---|
| Exposed RDP without MFA, brute force or leaked credential | 42% | Restore + hardening |
| Phishing with Office macro (Emotet, IcedID) | 18% | Restore + training |
| Fortinet exploit (CVE-2018-13379, CVE-2023-27997) | 12% | Patch + restore |
| Citrix NetScaler (CitrixBleed CVE-2023-4966) | 10% | Patch + restore |
| Compromise via Initial Access Broker | 8% | Entry-vector forensics |
| Other / unidentified | 10% | Case-by-case analysis |
Estimated distribution based on CISA AA23-325A and HD Doctor telemetry 2024-2025.
What NOT to do upon LockBit identification
- 1.Do not pay the ransom without analysis. For LockBit 3.0/Black cases there are keys released by Operation Cronos. Free decryptor attempt before any payment.
- 2.Do not randomly power off servers. RAM holds critical forensic artifacts (in-use keys, IoCs). Snapshot before any action.
- 3.Do not reinstall the system immediately. Wiping evidence blocks compromise forensics and breach-notification compliance.
- 4.Do not connect offline backups to the infected network. LockBit spreads via SMB. Connecting a clean backup without containment may encrypt everything.
- 5.Do not negotiate without proof of decryption. Operators must prove key possession by decrypting 1 test file before any move.
HD Doctor process for LockBit response
Technical response in 5 phases. Documented chain of custody for forensic report and regulatory notification.
- 1
Triage and containment (0 to 6h)
Network segment isolation, live VM snapshots, RAM capture on critical hosts, SIEM log preservation. Initial communication with client and DPO.
- 2
Compromise forensics (6 to 48h)
Identify exact variant (LockBit 2.0/3.0/Black/Green), entry vector, compromised accounts, data exfiltration (LockBit uses StealBit). Attack timeline.
- 3
Decryptor attempt (24 to 72h)
Match against Operation Cronos (NCA/FBI) key base, attempt with public decryptor for eligible variants, validation in isolated environment before production use.
- 4
Backup or physical media recovery (3 to 15 days)
Restore from clean backup (Veeam, Commvault, Azure Backup), recover VMs in ESXi/Hyper-V via encrypted VMDK reconstruction when applicable, recover SQL Server/Oracle databases.
- 5
Hardening and report (5 to 20 days)
Hardening plan (MFA, segmentation, patches, EDR), Active Directory review, technical forensic report for regulatory and judicial use.
Typical SLA for LockBit response
| Scenario | Turnaround |
|---|---|
| Initial triage and containment | 0 to 6h after contact |
| Compromise forensics | 24 to 72h |
| Public decryptor attempt | 24 to 72h |
| Critical backup or VM restore | 3 to 15 business days |
| Final technical report | 10 to 25 business days after containment |
- We operate 24×7 for initial response on corporate cases.
- Documented chain of custody enables court use of materials.
Affected systems and coverage
LockBit prefers Windows Server but has a Linux variant for ESXi. We cover the main environments.
| Family | Support | Notes |
|---|---|---|
| Windows Server 2012 R2 to 2022 | ✅ Full response | AD, file servers, SQL Server |
| VMware ESXi 6.0 to 8.0 | ✅ LockBit-Linux response | Encrypted VMDK, datastore |
| Hyper-V Windows Server | ✅ VHDX rebuild | Hyper-V cluster |
| Linux servers (RHEL, Ubuntu) | ✅ Backup + forensics | PostgreSQL, MySQL, NGINX |
| Veeam / Commvault backup | ✅ Guided restore | Includes forensics on backup tampering |
Why HD Doctor for LockBit response
- ⚡24×7 response within 6h for corporate cases, with direct senior engineer, no ticket queue.
- 🔓Updated base with Operation Cronos keys (NCA/FBI Feb 2024) for decryptor attempt before any payment.
- 📋Documented chain of custody for forensic use in expert reports and regulatory notifications within 72h.
- 💾Complementary physical recovery (Class 100 cleanroom) for drives with simultaneous encryption + hardware failure.
- 🏛️We serve government, hospitals and law firms with sector-specific NDA.
FAQ about LockBit
Is there a free LockBit decryptor?
Partially yes. Operation Cronos (Feb 2024, NCA + FBI + Europol) released roughly 7,000 decryption keys for specific LockBit 2.0 and 3.0/Black victims. Not every case has a key available, but matching against the official base is the free first step before considering payment.
How long until recovery after a LockBit attack?
It varies widely. Initial containment and forensics: 24 to 72h. Decryptor attempt: 24 to 72h. Restore from clean backup (if it exists): 3 to 10 days. Full rebuild without backup: 15 to 45 days. Detailed SLA is defined after scope triage.
Should I pay LockBit's ransom?
Technical recommendation: no, not before exhausting alternatives. Reasons: (1) Operation Cronos may have your key; (2) payment does not guarantee recovery (several LockBit Black post-Cronos cases delivered no working key); (3) may breach OFAC sanctions; (4) funds future attacks. Evaluate with legal and cyber insurance before any move.
Did LockBit steal my data before encrypting?
Likely yes. LockBit uses StealBit (proprietary tool) to exfiltrate data before encryption as a base for double extortion. The leak appears on the group's darknet site. Regulatory notification is mandatory within 72h if personal data is involved.
How to avoid reinfection?
Five mandatory post-incident controls: (1) MFA on ALL remote access (RDP, VPN, RMM); (2) critical patches applied (Fortinet, Citrix, Microsoft Exchange); (3) active EDR (CrowdStrike, SentinelOne, Defender for Endpoint); (4) immutable offline backup; (5) network segmentation with VLANs and internal firewall rules. Our report includes a prioritized hardening plan.
Under LockBit attack right now?
Response within 6h for corporate cases. Documented chain of custody.