Lockbit v3.0

LockBit v3.0 is a malicious software variant, known for its capability to encrypt up to 25,000 files per minute. This potent ransomware was first encountered almost a year ago, and despite not being the fastest of its kind, it poses a significant threat due to the average time required to detect and mitigate a breach—approximately 280 days. Its primary mode of operation involves exploiting and damaging computer systems, often infiltrating through suspicious downloads, emails, or websites without the user's knowledge. Once embedded, LockBit v3.0 can disrupt operations, steal personal information, or hold data hostage for ransom. Around the same time as the release of LockBit v3.0, another malware, BabLock, emerged. However, our analysis indicates that most of BabLock's structure still resembles LockBit v2.0, leading us to believe that it may originate from a different affiliate or group. The timing of their appearances led to initial speculation about a potential connection between the two entities. However, after nearly a year since the introduction of LockBit v3.0, recent attacks involving BabLock have shown no changes in its payload. This observation strengthens our stance that BabLock and the actual LockBit group are neither connected nor closely affiliated. Despite the similarities in their modus operandi and the coincidental timing of their emergence, these two threats appear to be distinct, each posing unique challenges in cybersecurity.