LockBit is a ransomware-as-a-service (RaaS) operation that emerged in 2019 and quickly became one of the most prolific and damaging ransomware groups globally. Its business model relies on leasing ransomware infrastructure—malware, payment portals, and leak sites—to affiliates, who then carry out attacks and share ransom proceeds with the core group. LockBit’s double-extortion tactics, encrypting data and threatening public leaks, have targeted sectors including healthcare, education, and critical infrastructure.
By 2022, LockBit was responsible for 44% of all ransomware incidents worldwide and was the most widely deployed ransomware variant, according to U.S. government agencies. In the U.S. alone, LockBit was used in about 1,700 attacks from 2020 to 2023, with $91 million paid in ransoms. Its cumulative ransom demands have reached into the hundreds of millions of dollars.