Kaspersky researchers revisit the leaked LockBit 3.0 builder and share insights into a real-life incident involving a custom targeted ransomware variant created with this builder.

Securelist is a cybersecurity blog and research platform operated by Kaspersky Lab. It offers insights, analysis, and reports on cybersecurity threats, vulnerabilities, and malware campaigns. Developers can learn about emerging cyber threats, security best practices, and mitigation strategies to protect their applications and systems. Additionally, Securelist provides insights into cybersecurity trends, threat intelligence, and industry developments, offering resources for cybersecurity professionals.

Securelist

The post discusses a real-life incident response case involving a custom LockBit build generated with the leaked LockBit 3.0 builder. It highlights the customization options available to attackers and provides preventive actions against ransomware attacks.

Leaked LockBit builder in a real-life incident response case

The recent LockBit takedown and custom LockBit builds

Geography of the leaked LockBit builder-based attacks

A real-life incident response case involving a custom LockBit build

Preventive actions against ransomware attacks