Group Profile: LockBit
Perfil del grupo ransomware segun BushidoUK Ransomware Vulnerability Matrix. Incluye vulnerabilidades conocidas, herramientas y TTPs asociadas.
LockBit's Exploited Vulnerabilities
> [!NOTE]
> This is the list of vulnerabilities that have been observed during intrusions that lead to LockBit ransomware deployment or data exfiltration and leaks published to LockBit's Tor Site
Apache
| Product | CVE(s) | Ransomware Group(s) | Source(s) |
|---|
| Log4j | CVE-2021-44228 ("Log4Shell") | LockBit | <a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-165a" rel="noopener" target="_blank">cisa.gov</a> |
Citrix
| Product | CVE(s) | Ransomware Group(s) | Source(s) |
|---|
| NetScaler ADC & Gateway | CVE-2023-4966 ("Citrixbleed") | LockBit | <a href="https://doublepulsar.com/lockbit-ransomware-group-assemble-strike-team-to-breach-banks-law-firms-and-governments-4220580bfcee" rel="noopener" target="_blank">doublepulsar.com</a> |
Fortinet
| Product | CVE(s) | Ransomware Group(s) | Source(s) |
|---|
| FortiOS | CVE-2018-13379 | LockBit | <a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-165a" rel="noopener" target="_blank">cisa.gov</a> |
Fortra
| Product | CVE(s) | Ransomware Group(s) | Source(s) |
|---|
| GoAnywhere Managed File Transfer | CVE-2023-0669 | LockBit | <a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-165a" rel="noopener" target="_blank">cisa.gov</a> |
F5
| Product | CVE(s) | Ransomware Group(s) | Source(s) |
|---|
| iControl REST | CVE-2021-22986 | LockBit | <a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-165a" rel="noopener" target="_blank">cisa.gov</a> |
PaperCut
| Product | CVE(s) | Ransomware Group(s) | Source(s) |
|---|
| PaperCut Application Server | CVE-2023–27350 & CVE-2023–27351 | LockBit | <a href="https://twitter.com/MsftSecIntel/status/1651346653901725696" rel="noopener" target="_blank">twitter.com/MsftSecIntel</a> |
Windows
| Product | CVE(s) | Ransomware Group(s) | Source(s) |
|---|
| NetLogon | CVE-2020-1472 ("ZeroLogon") | LockBit | <a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-165a" rel="noopener" target="_blank">cisa.gov</a> |
| Remote Desktop Services | CVE-2019-0708 ("BlueKeep") | LockBit | <a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-165a" rel="noopener" target="_blank">cisa.gov</a> |
---
#### Sources
| Date Published | Report |
|---|
| 13 Nov 2023 | https://doublepulsar.com/lockbit-ransomware-group-assemble-strike-team-to-breach-banks-law-firms-and-governments-4220580bfcee |
| 14 June 2023 | https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-165a |
| 26 April 2023 | https://twitter.com/MsftSecIntel/status/1651346653901725696 |
Referencias