malware family

LockBit

unknownentity:malware_familyransomware · 1 source

LockBit operators tend to be very indiscriminate and opportunistic in their targeting. Actors behind this attack will use a variety of methods to gain initial access, up to and including basic methods such as brute force.

Curated · btcintel

claims we make, each with its source and citation · sources may contradict; we show the set, never a score

Facts

id: lockbit
kind: malware family
status: unknown
aliases: ABCD ransomware
jurisdictions: —
claims naming it: 14 · 0 attributions · 0 relations · 0 events

Identifiers

misp-galaxy 8eda8bf1-db5a-412d-8511-45e2f7621d51via misp-galaxy-ransomware

Relations

computedno relations recorded for this entity

Events

computedno dated events recorded for this entity

Claims naming this entitynewest first · 14 of 14

LockBitransomwarepayment
subjecttransaction0ed06d5b56…d12787d2b7
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment bc1qyuunv9pz6f4qpgd0c0wmenu9zhr6u57yjf4afd · 5,310,674,450 sat · time 2022-09-07 01:27 UTC · url https://ransomwhe.re/#address/bc1qyuunv9pz6f4qpgd0c0wmenu9zhr6u57yjf4afd
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_32289btcintel:annotations:32289@v3 sha256:266a44f43d78ee27
confidencetrusted provider · 50
LockBitransomwarepayment address
subjectaddressbc1qyuunv9pz6f4qpgd0c0wmenu9zhr6u57yjf4afd
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw LockBit · url https://ransomwhe.re/#address/bc1qyuunv9pz6f4qpgd0c0wmenu9zhr6u57yjf4afd
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_32288btcintel:annotations:32288@v2 sha256:2fbe98a48d40f4fb
confidencetrusted provider · 50
LockBitransomwarepayment
subjecttransaction0e127a6544…473178177a
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment bc1q9x0sg3w0gwl0yfyml78zp7mdpuan005scwvytu · 287,590,000 sat · time 2022-02-05 22:16 UTC · url https://ransomwhe.re/#address/bc1q9x0sg3w0gwl0yfyml78zp7mdpuan005scwvytu
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_27021btcintel:annotations:27021@v3 sha256:ee59c28277858076
confidencetrusted provider · 50
LockBitransomwarepayment address
subjectaddressbc1q9x0sg3w0gwl0yfyml78zp7mdpuan005scwvytu
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw LockBit · url https://ransomwhe.re/#address/bc1q9x0sg3w0gwl0yfyml78zp7mdpuan005scwvytu
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_27020btcintel:annotations:27020@v2 sha256:809b28ac6cabfcbf
confidencetrusted provider · 50
LockBitransomwarepayment
subjecttransactionc67d58c69b…53842a7ffd
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1KsiEH5ZrfS3XhLVUU758rMKnP65kz2GYz · 100,000 sat · time 2020-12-01 10:50 UTC · url https://ransomwhe.re/#address/1KsiEH5ZrfS3XhLVUU758rMKnP65kz2GYz
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_25780btcintel:annotations:25780@v3 sha256:55b609ff23cc7339
confidencetrusted provider · 50
LockBitransomwarepayment
subjecttransactionbd2d3aad05…0ac5203f2b
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1KsiEH5ZrfS3XhLVUU758rMKnP65kz2GYz · 79,943,800 sat · time 2020-12-01 11:19 UTC · url https://ransomwhe.re/#address/1KsiEH5ZrfS3XhLVUU758rMKnP65kz2GYz
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_25779btcintel:annotations:25779@v3 sha256:a000261c9c22d36c
confidencetrusted provider · 50
LockBitransomwarepayment
subjecttransaction120fef3d10…4fe8029e54
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1KsiEH5ZrfS3XhLVUU758rMKnP65kz2GYz · 67,905,816 sat · time 2020-12-03 09:19 UTC · url https://ransomwhe.re/#address/1KsiEH5ZrfS3XhLVUU758rMKnP65kz2GYz
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_25778btcintel:annotations:25778@v3 sha256:02b76a04ed275c88
confidencetrusted provider · 50
LockBitransomwarepayment
subjecttransaction5888bd1d20…213832ed2c
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1KsiEH5ZrfS3XhLVUU758rMKnP65kz2GYz · 5,100,000 sat · time 2020-12-04 01:00 UTC · url https://ransomwhe.re/#address/1KsiEH5ZrfS3XhLVUU758rMKnP65kz2GYz
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_25777btcintel:annotations:25777@v3 sha256:f3fa2681eff63c38
confidencetrusted provider · 50
LockBitransomwarepayment
subjecttransaction230fce9438…c091eb8a93
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1KsiEH5ZrfS3XhLVUU758rMKnP65kz2GYz · 67,136,070 sat · time 2020-12-04 06:39 UTC · url https://ransomwhe.re/#address/1KsiEH5ZrfS3XhLVUU758rMKnP65kz2GYz
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_25776btcintel:annotations:25776@v3 sha256:24d70b8a9687dfd4
confidencetrusted provider · 50
LockBitransomwarepayment
subjecttransaction86217842ac…8cc1e107aa
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1KsiEH5ZrfS3XhLVUU758rMKnP65kz2GYz · 37,124,770 sat · time 2020-12-04 06:55 UTC · url https://ransomwhe.re/#address/1KsiEH5ZrfS3XhLVUU758rMKnP65kz2GYz
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_25775btcintel:annotations:25775@v3 sha256:53178850295b7bdd
confidencetrusted provider · 50
LockBitransomwarepayment
subjecttransactionb281bf3fca…06353c9fe8
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1KsiEH5ZrfS3XhLVUU758rMKnP65kz2GYz · 26,000,000 sat · time 2020-12-14 00:34 UTC · url https://ransomwhe.re/#address/1KsiEH5ZrfS3XhLVUU758rMKnP65kz2GYz
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_25774btcintel:annotations:25774@v3 sha256:f257c084aa9e67ff
confidencetrusted provider · 50
LockBitransomwarepayment
subjecttransactiond4834cf20c…6abde9b038
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1KsiEH5ZrfS3XhLVUU758rMKnP65kz2GYz · 33,219,346 sat · time 2020-12-14 06:12 UTC · url https://ransomwhe.re/#address/1KsiEH5ZrfS3XhLVUU758rMKnP65kz2GYz
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_25773btcintel:annotations:25773@v3 sha256:d1d349422bb1465b
confidencetrusted provider · 50
LockBitransomwarepayment
subjecttransaction87c6dffb5e…f121668108
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1KsiEH5ZrfS3XhLVUU758rMKnP65kz2GYz · 29,518 sat · time 2020-12-21 06:30 UTC · url https://ransomwhe.re/#address/1KsiEH5ZrfS3XhLVUU758rMKnP65kz2GYz
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_25772btcintel:annotations:25772@v3 sha256:c2bbe36040ad2478
confidencetrusted provider · 50
LockBitransomwarepayment address
subjectaddress1KsiEH5ZrfS3XhLVUU758rMKnP65kz2GYz
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw LockBit · url https://ransomwhe.re/#address/1KsiEH5ZrfS3XhLVUU758rMKnP65kz2GYz
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_25771btcintel:annotations:25771@v2 sha256:75d1dce81dd1f510
confidencetrusted provider · 50

Subjects14 subjects carry a claim naming this entity · a sample

Community

notes from Nostr labelers · never merged with the bands above · not endorsed

Community content is indexed from Nostr and not endorsed by btcintel.

not computed yetNot indexed yet: the community index has not looked at this subject.