The following pillars address the contested question of whether post-Cronos LockBit (4.0/5.0) represents the same operator cluster or a partial splinter. Code continuity is not contested; human continuity is the open question.

LockBit 3.0 / Black shares documented technical similarities with BlackMatter and ALPHV/BlackCat in configuration structures and specific routines. Multiple vendors confirm these similarities but the interpretation remains contested: some assess code borrowing or licensing, others assess convergent design by developers familiar with the same code base. There is no confirmed evidence of a unified actor behind all three families. Confidence: CREDIBLE for the technical similarity; ANALYST INFERENCE for any shared authorship or collaboration.

LockBit operates a pure RaaS model. A core developer team maintains encryptors, infrastructure, and affiliate portals while independent affiliates supply initial access, deploy the malware, and manage victim negotiations. Revenue is split 80% to affiliates and 20% to the LockBit operator tier, per Chainalysis on-chain analysis confirmed by TRM Labs. DOJ reporting confirmed that 114 affiliates paid to join the LockBit program as of February 2024. The operator tier collects fees passively; affiliate wallets receive victim payments first, with the operator share extracted via the built-in split mechanism.

LockBit has recruited on Russian-language underground forums, emphasizing speed, automation, and affiliate-friendly terms. Vetting is described in open sources as moderate, with preference for affiliates who can demonstrate prior access capabilities and ability to deliver large enterprise victims. Some leak data suggests blacklisting of unreliable partners. Confidence: CREDIBLE (single-source / limited open corroboration on vetting specifics).

The bug-bounty program launched with LockBit 3.0 offered financial rewards for identification of vulnerabilities in the ransomware and its infrastructure, reflecting an unusual professionalization effort and likely an attempt to address leaks and security failures.

• Initial demands: Hundreds of thousands to multiple millions USD; IBM reported an average payment of approximately $1.5 million for LockBit 3.0 in 2022
• Time-limited discounts: Affiliates commonly offer 20-50% reductions if paid within days of initial demand
• Escalation ladder: Countdown timers, data sampling, threat to contact customers or regulators, DDoS attacks (3.0+), and full publication
• Multi-extortion from 3.0: Triple extortion adds DDoS or targeted harassment of victims alongside encryption and data publication threats
• Communication channel: TOR-hosted chat portal linked from ransom note via unique victim ID; some affiliates also used email and secure messaging

Note: LockBit is a RaaS, so CVE exploitation reflects affiliate tradecraft, not a single actor. Not all CVEs above are used in every LockBit campaign. Attribution of a specific CVE to "LockBit" means it has been documented in campaigns by LockBit affiliates.

• Compromised credentials / RDP exploitation: Brute-forcing or purchasing credentials for RDP and VPN; the most consistent vector across all affiliate-tier operators
• Vulnerability exploitation: Edge device and appliance CVEs (see table above); Citrix Bleed (CVE-2023-4966) associated with multiple high-profile 2023 victims including Boeing and ICBC
• Phishing: Email-borne malware or credential-harvesting campaigns; used by certain affiliates as a preferred entry method
• MSP and supply-chain compromise: Documented cases of abusing trusted remote management tools operated by managed service providers

• Domain admin credential leverage to push payloads via PsExec, SMB shares, and Group Policy Objects
• Disabling security tools and services via PowerShell, Group Policy, and registry edits prior to deployment
• Living-off-the-land (LOTL) techniques using built-in Windows tools
• Automated network share and domain controller discovery (introduced with v2.0); accelerates spread across Windows domains
• StealBit exfiltration tool (v2.0+): custom-built tool for high-speed data theft prior to encryption; all StealBit servers seized in Operation Cronos
• rclone used as supplementary exfiltration mechanism for cloud storage staging

All LockBit versions use a hybrid encryption scheme: symmetric encryption (typically AES) for file content combined with asymmetric encryption (RSA or ECC) for key protection. Per-file or per-session keys are managed via embedded public keys, with private keys held by the operator tier.

• v1.0 / v2.0: Multi-threaded encryption for speed; v2.0 marketed as the fastest available at release; Volume Shadow Copy deletion
• v3.0 / Black: Selective encryption (partial file encryption to prioritize critical data while maximizing speed); packed binaries; control-flow obfuscation; anti-debugging checks
• Green variant: BCryptGenRandom for faster key generation, derived from Conti source code
• v5.0: Randomized 16-character file extensions; further removal of infection markers; enhanced cross-platform obfuscation per Trend Micro analysis

Full mapping: AA23-165A documents over 40 techniques and roughly 30 affiliate tools. The set above is curated for detection and hardening value; it is not exhaustive.

LockBit predominantly uses Bitcoin for ransom payments, with Monero available in some affiliate arrangements for added privacy. Victim payments go to affiliate-controlled wallets specified in negotiation chats, with the 20% operator share extracted through the built-in affiliate panel mechanism. TRM Labs confirmed this 80/20 split via on-chain analysis of payment flow clusters. DOJ attributed more than $120 million in confirmed ransom receipts through February 2024; TRM Labs documented at least $44 million in 2022 alone.

OFAC designated Dmitry Yuryevich Khoroshev ("LockBitSupp") and associated wallets on May 7, 2024, in coordination with the UK National Crime Agency and Australian Federal Police. Additional wallet clusters linked to LockBit affiliates have been designated over time. Analysts should expect ongoing OFAC designations as new wallets are linked via blockchain forensics; however, many affiliate-level wallets will remain undesignated and overlap with unrelated criminal activity.

LockBit's growth trajectory from market entrant to dominant player spans four years:

• LockBit 1.0 (2020): Approximately 5% of global ransomware attacks in its first operational year (IBM)
• LockBit 2.0 (2021): Rose to approximately 10% of global ransomware attacks
• LockBit 3.0 (2022): Exceeded 20% of global attacks; Akamai research recorded 39% of total ransomware victims in one measured period, triple the next-highest group
• 2023: NCC Group recorded more than 1,000 LockBit victims, equaling 22% of all identified ransomware victims that year; separately assessed at up to 44% of all global ransomware incidents at peak
• Post-Cronos (2024-2026): Market share declined; LockBit remained the top actor by victim count in May 2024 (10% of attacks per Infosecurity Magazine) but at substantially reduced absolute and relative volume

• Free LockBit 3.0 Black decryptor developed by Japanese Police with Europol support; available at nomoreransom.org
• 7,000+ decryption keys available to victims through lockbitvictims.ic3.gov (FBI IC3 portal)
• Keys are incident-specific; not all keys restore all victims; matching requires contact with FBI or NCA
• No universal decryptor exists for LockBit 4.0 or 5.0 variants as of May 2026

• Named operator: Dmitry Yuryevich Khoroshev is a Russian national from Voronezh, Russia; identified by DOJ, OFAC, and NCA via a converging investigation (CONFIRMED)
• CIS avoidance: Code-level locale and keyboard checks exclude Russian/CIS systems; observed victim geography consistently excludes Russia and most CIS countries (CONFIRMED)
• Forum presence: LockBit recruitment and operations advertised on Russian-language cybercrime forums (CONFIRMED)
• No domestic prosecution: No public evidence of Russian authorities charging any LockBit operator despite global impact, consistent with tolerated-cybercrime patterns (CONFIRMED)
• Named affiliates: Multiple charged individuals are Russian nationals; others assessed as Russian-speaking based on operational communications (CONFIRMED for named; CREDIBLE for broader affiliate pool)

Open sources and government advisories do not provide conclusive evidence that LockBit is directed by or operating under the control of FSB, SVR, or GRU. The most defensible assessment is that LockBit is a financially motivated, Russian-language cybercriminal ecosystem operating from jurisdictions that provide practical safe harbor, with de-facto tolerance from Russian authorities in exchange for avoiding domestic targeting.

Three indicators suggest proximity to, but not control by, Russian state interests:

• Colonel Cassad donation: Chainalysis analysis identified a LockBit administrator donating cryptocurrency to "Colonel Cassad," a pro-Russia military journalist in Sevastopol with documented ties to Russian nationalist networks. This is the single most operationally significant indicator of informal state-proximate behavior (CREDIBLE for the transfer; ANALYST INFERENCE for its significance)
• Evil Corp affiliate overlap: Mandiant tracked UNC2165, a cluster of Evil Corp-affiliated operators, as shifting to LockBit to evade US sanctions. Evil Corp itself has documented direct FSB connections per US government indictments. The overlap does not make LockBit an FSB asset, but it places FSB-connected actors within the LockBit affiliate ecosystem (CONFIRMED overlap; ANALYST INFERENCE for implications)
• Data intelligence value: The sectors and organizations targeted by LockBit affiliates include defense contractors, aerospace organizations, government systems, and critical infrastructure that would have intelligence value for the Russian state. Whether any stolen data is shared with Russian intelligence is not documented in open sources (ANALYST INFERENCE)

LockBit has not undergone a formal rebranding; the core brand has been maintained across all versions. Post-Cronos, versions 4.0 and 5.0 represent version-number escalation as a credibility signal to potential affiliates rather than a substantive identity change. The continued use of the LockBit brand name is operationally significant: it carries recognition that attracts affiliates but also makes the group a persistent high-priority law-enforcement target. The decision to maintain the brand rather than rebrand (as many disrupted groups do) suggests either operator confidence in resilience or recognition that a new brand would not carry the same affiliate recruitment value.

• Continued development: LockBit 5.0 (September 2025) demonstrates ongoing technical investment and operator capability; cross-platform support and anti-analysis improvements indicate the developer tier remains active
• Revenue contraction: $2.3M total in five post-Cronos months (Dec 2024 to Apr 2025) versus $44M in 2022 alone represents an approximate 80-90% revenue decline from peak; this is the sharpest measurable indicator of ecosystem degradation
• Market share erosion: Competitor RaaS operations (Akira, Qilin, DragonForce, others) have gained affiliates following Cronos; LockBit no longer dominates the ransomware landscape as it did in 2022-2023
• Brand risk: Two major public compromises in fourteen months create structural affiliate confidence problems; the May 2025 breach exposed not just infrastructure but the security of the affiliate relationship itself
• Cumulative law enforcement pressure: No other ransomware group has faced simultaneous infrastructure seizure, leadership identification/sanction, decryptor release, and a secondary anonymous breach within a 15-month period; the combined effect on LockBit's ability to recruit credible affiliates is assessed as significant