Actor profile· ACT-003
LockBit
DisruptedAffiliate modelLeak-site choreographyNo ATT&CK entry located
The clearest affiliate operation in the corpus, and the one that most often behaved like a brand managing its franchisees — expelling the affiliate that encrypted a children’s hospital at 22-1218, staging listings against Boeing at 23-1110.
16
Files naming the group
7
Sectors in the corpus
4
Jurisdictions
2022
Earliest file
Campaign timeline14 most recent of 16
MAY 2026Delano Public Schools26-0513A month between attack and claim. Leak-site listings record negotiation failures, not attacks — and that biases everyone’s data.SEP 2025Ransomware ecosystem25-0908Removing the largest operator did not reduce the market. It redistributed it into smaller, less trackable operations.MAY 2025Not applicable25-0525Somebody looked at the population of people who wanted to run ransomware, decided it was larger than the population who could, and built a product for the difference.MAY 2025Multiple, unidentified25-0519A $28.7m demand generates a board meeting, a law firm, an insurer and eventually a public record. A $40,000 demand generates a wire transfer.MAY 2025Multiple, global25-0517An affiliate panel records who was attacked because the operation needed to track it. No notification law stands between the event and the row.MAY 2025Not applicable25-0511A leak-site count is a measure of publication, not of income. This is the first case where both can be looked at side by side.MAY 2025Not applicable25-0510A headline built on 62,400 of anything would be describing a quantity of database rows.JUL 2024Fintech customers24-0702The partnership had ended the year before the intrusion. The records had not.JUN 2024Evolve Bank & Trust24-0626The usual version is a supplier the affected person has never heard of. Here it is a bank they were arguably banking with without knowing.JUN 2024Evolve Bank & Trust24-0623It had the data, it could read the data, and it still named the wrong institution.NOV 2023Boeing23-1110A dump is chosen for extortion value, not evidence. This one disclosed its own method.NOV 2023ICBC Financial Services23-1108Settlement data proposed by USB stick, between two of the largest financial institutions on earth.OCT 2023Citrix NetScaler appliances23-1010A stolen session token arrives after authentication. Multi-factor is not bypassed — it is never consulted.JAN 2023Royal Mail23-0110No database at the centre of it. A national postal operator simply stopped being able to send a parcel abroad.
All 16 files naming LockBit© 2026 ForensicPost Media · the desk · newsletter · attribution policyGlossary