The LOCKBIT 2.0 ransomware group has been highly active in the past few months and
It has gained huge popularity among threat actors since the first version of the ransomware family appeared in September 2019. It is distributed via various underground (russian)forums, and targets victims in the United States, Canada, Europe, Asia, and Latin America.
LOCKBIT 2.0 developers customize ransomware variants as per their affiliates’ needs.
The malware uses the double extortion technique to compel victims into paying ransoms. Through this technique, attackers exfiltrate the victim’s data, after which they proceed to encrypt the data on the victim’s system. Data encryption is followed by the attackers demand ransom in exchange for a decryptor. If the victim refuses or cannot pay the ransom, the attackers threatens to leak the data.The extension used by this ransomware is “.lockbit”.