Security Resilience

Threat actor · all actors

LockBitMISP-8eda8bf1 criminal

aka LockBit, ABCD ransomware

Last updated: 2026-10-16

7attributed CVEs
0ATT&CK techniques
15.7IDF score (tooling uniqueness)
0exclusive CVEs
2019–2023years active

About this actor

LockBit operators tend to be very indiscriminate and opportunistic in their targeting. Actors behind this attack will use a variety of methods to gain initial access, up to and including basic methods such as brute force. After gaining initial access the actor follows a fairly typical escalation, lateral movement and ransomware execution playbook. LockBit operators tend to have a very brief dwell time, executing the final ransomware payload as quickly as they are able to. LockBit ransomware has the built-in lateral movement features; given adequate permissions throughout the targeted environment.

How we know this

Data origin
MISP threat-actor galaxy Imported from the open-source MISP threat-actor galaxy.
Techniques
No ATT&CK techniques mapped.
Named victims
None on file.

Thin data: No ATT&CK techniques are mapped yet — the behavioural profile is empty.

See how actor data is built for the full pipeline.

Activity timeline

2019: 2 CVE published220192020: 1 CVE published120202021: 2 CVE published2021: 5 KEV added720212023: 2 CVE published2023: 2 KEV added42023
CVE publishedKEV added

Profile

CVERiskCVSSEPSSPublishedProducts
CVE-2021-44228 KEV10.010.01.00002021-12-10see CVE
CVE-2019-0708 KEV9.99.81.00002019-05-16see CVE
CVE-2021-22986 KEV9.99.80.99902021-03-31see CVE
CVE-2023-27350 KEV9.99.81.00002023-04-20see CVE
CVE-2018-13379 KEV9.59.11.00002019-06-04see CVE
CVE-2023-0669 KEV8.17.21.00002023-02-06see CVE
CVE-2020-1472 KEV7.55.50.99512020-08-17see CVE

No techniques attributed.

Co-occurring actors

Similar actors

Overlapping CVEs

Active in same years

Same category