Using the LockBit builder to generate targeted ransomware

Kaspersky examines the leaked LockBit 3.0 builder and a real incident where attackers used stolen Administrator credentials to produce a custom LockBit variant that propagated via PsExec, disabled Windows Defender, deleted event logs, used Cobalt Strike and SessionGopher for credential harvesting, and caused network-wide encryption; the report dissects the builder/configuration, tests available decryption tools, maps global use of leaked builds, and recommends mitigations such as robust endpoint protection, MDR, credential controls, patching, and backups.