threat actor · Origin not attributed
LockBit
1 CVE exploited (1 in CISA KEV)
The strips, in order: the CVEs it is reported to exploit by weakness class and by vendor, the techniques ATT&CK says it uses by tactic, its malware and tools, then who it targets. Each square is one record.
Open LockBit's actor pageDark Reading described LockBit as a ransomware group operational from 2020 to 2024, collecting more than $500 million in ransom, while noting that some elements remained active. Dark Reading reported LockBit ransomware deployment in at least one campaign involving exploitation of CVE-2026-1731 in Bomgar Remote Support and older PRA versions. The Hacker News reported that ReliaQuest identified an announced alliance between LockBit, Qilin and DragonForce, and that LockBit 5.0 was advertised on 3 September 2025. Dark Reading reported that the FBI disrupted LockBit’s infrastructure through Operation Cronos and exposed affiliates.
Source: CyberSIXT profile, 26 October 2026. The opening of CyberSIXT's sourced profile of this actor; the profile cites its sources.
- Origin
- Not attributed
- On record in
- CyberSIXT
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-14. Sources: MITRE ATT&CK (© The MITRE Corporation, reproduced and distributed with its permission), the MISP Galaxy (CC0), and CyberSIXT's own coverage. Use this via MCP