Inside LockBit: Defense Lessons from the Leaked LockBit Negotiations
ID: cc7803aa-7088-5a10-86a7-cd16552a0ad9
STIX ID: report--cc7803aa-7088-5a10-86a7-cd16552a0ad9
Feed Name: Qualys Blog
Threat Score
The report summarizes a LockBit affiliate panel breach that leaked a MySQL database containing nearly 60k bitcoin addresses and over 4.4k negotiation messages from Dec 2024–Apr 2025. It reviews LockBit's evolution as a RaaS operation, common initial access and post-compromise tactics (lateral movement, data exfiltration, encryption), targeted assets (Veeam, VMware/vCenter/ESXi, NAS), and a prioritized list of frequently exploited CVEs with patching and mitigation recommendations to reduce exposure.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.