malware family

LockBit 2.0

unknownentity:malware_familyransomware · 1 source

[LockBit 2.0](https://attack.mitre.org/software/S1199) is an affiliate-based Ransomware-as-a-Service (RaaS) that has been in use since at least June 2021 as the successor to LockBit Ransomware. [LockBit 2.0](https://attack.mitre.org/software/S1199) has versions capable of infecting Windows and VMware ESXi virtual machines, and has been observed targeting multiple industry verticals globally.(Citation: FBI Lockbit 2.0 FEB 2022)(Citation: Palo Alto Lockbit 2.0 JUN 2022)

Curated · btcintel

claims we make, each with its source and citation · sources may contradict; we show the set, never a score

Facts

id: lockbit-2-0
kind: malware family
status: unknown
aliases: —
jurisdictions: —
claims naming it: 10 · 0 attributions · 0 relations · 0 events

Identifiers

attack S1199via mitre-attack

Relations

computedno relations recorded for this entity

Events

computedno dated events recorded for this entity

Claims naming this entitynewest first · 10 of 10

LockBit 2.0ransomwarepayment
subjecttransaction4c53e646e4…0e867f0c55
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment bc1qr4mhf2zqtgd45x9clfmuekf42z4eglh4aydlnk · 47,950,000 sat · time 2021-09-21 18:04 UTC · url https://ransomwhe.re/#address/bc1qr4mhf2zqtgd45x9clfmuekf42z4eglh4aydlnk
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_25770btcintel:annotations:25770@v3 sha256:3e809c5057bb8dee
confidencetrusted provider · 50
LockBit 2.0ransomwarepayment address
subjectaddressbc1qr4mhf2zqtgd45x9clfmuekf42z4eglh4aydlnk
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw LockBit 2.0 · url https://ransomwhe.re/#address/bc1qr4mhf2zqtgd45x9clfmuekf42z4eglh4aydlnk
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_25769btcintel:annotations:25769@v2 sha256:ffc229cfcba7233e
confidencetrusted provider · 50
LockBit 2.0ransomwarepayment
subjecttransaction06e72606ed…d8f45c5955
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment bc1qwx9y37xd8sznjj0yw85q9fd9qfyaur9xasc2h4 · 2,900,000 sat · time 2021-06-29 20:19 UTC · url https://ransomwhe.re/#address/bc1qwx9y37xd8sznjj0yw85q9fd9qfyaur9xasc2h4
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_25076btcintel:annotations:25076@v3 sha256:207b4fa2c038eaa4
confidencetrusted provider · 50
LockBit 2.0ransomwarepayment
subjecttransactionfdd554c428…2a62cc4f51
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment bc1qwx9y37xd8sznjj0yw85q9fd9qfyaur9xasc2h4 · 2,978,000 sat · time 2021-06-29 20:16 UTC · url https://ransomwhe.re/#address/bc1qwx9y37xd8sznjj0yw85q9fd9qfyaur9xasc2h4
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_25075btcintel:annotations:25075@v3 sha256:3fe1aa1f74919e15
confidencetrusted provider · 50
LockBit 2.0ransomwarepayment
subjecttransaction46c25aaf23…d7d845ddf5
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment bc1qwx9y37xd8sznjj0yw85q9fd9qfyaur9xasc2h4 · 4,376,000 sat · time 2021-06-30 09:53 UTC · url https://ransomwhe.re/#address/bc1qwx9y37xd8sznjj0yw85q9fd9qfyaur9xasc2h4
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_25074btcintel:annotations:25074@v3 sha256:d638660c6ba34707
confidencetrusted provider · 50
LockBit 2.0ransomwarepayment
subjecttransaction81033689d5…50cb78f497
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment bc1qwx9y37xd8sznjj0yw85q9fd9qfyaur9xasc2h4 · 733,000 sat · time 2021-07-07 20:39 UTC · url https://ransomwhe.re/#address/bc1qwx9y37xd8sznjj0yw85q9fd9qfyaur9xasc2h4
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_25073btcintel:annotations:25073@v3 sha256:7ef989b06736693e
confidencetrusted provider · 50
LockBit 2.0ransomwarepayment
subjecttransaction86b8eaf3ce…43483989d9
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment bc1qwx9y37xd8sznjj0yw85q9fd9qfyaur9xasc2h4 · 53,000 sat · time 2021-07-28 17:05 UTC · url https://ransomwhe.re/#address/bc1qwx9y37xd8sznjj0yw85q9fd9qfyaur9xasc2h4
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_25072btcintel:annotations:25072@v3 sha256:473b385445de098a
confidencetrusted provider · 50
LockBit 2.0ransomwarepayment
subjecttransaction604f43b862…ed2bef1d1b
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment bc1qwx9y37xd8sznjj0yw85q9fd9qfyaur9xasc2h4 · 24,993,000 sat · time 2021-07-28 17:16 UTC · url https://ransomwhe.re/#address/bc1qwx9y37xd8sznjj0yw85q9fd9qfyaur9xasc2h4
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_25071btcintel:annotations:25071@v3 sha256:0adf2508a669375b
confidencetrusted provider · 50
LockBit 2.0ransomwarepayment
subjecttransaction0ecf16150e…6d1b3f1f02
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment bc1qwx9y37xd8sznjj0yw85q9fd9qfyaur9xasc2h4 · 6,273,000 sat · time 2021-07-29 04:55 UTC · url https://ransomwhe.re/#address/bc1qwx9y37xd8sznjj0yw85q9fd9qfyaur9xasc2h4
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_25070btcintel:annotations:25070@v3 sha256:f2bf3279219ad15b
confidencetrusted provider · 50
LockBit 2.0ransomwarepayment address
subjectaddressbc1qwx9y37xd8sznjj0yw85q9fd9qfyaur9xasc2h4
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw LockBit 2.0 · url https://ransomwhe.re/#address/bc1qwx9y37xd8sznjj0yw85q9fd9qfyaur9xasc2h4
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_25069btcintel:annotations:25069@v2 sha256:95ca1c4f0ad03d81
confidencetrusted provider · 50

Subjects10 subjects carry a claim naming this entity · a sample

Community

notes from Nostr labelers · never merged with the bands above · not endorsed

Community content is indexed from Nostr and not endorsed by btcintel.

not computed yetNot indexed yet: the community index has not looked at this subject.