LockBit 3.0 Variant Generates Custom, Self-Propagating Malware

Kaspersky responded to an attack in West Africa that used a customized LockBit 3.0-derived ransomware variant created from a leaked builder; the malware disabled Windows Defender, encrypted network shares, deleted event logs, and could target specific systems and file types. The report warns the leaked builder enables less-skilled actors to produce potent, self-propagating ransomware and recommends standard mitigations such as EDR/MDR, MFA, network segmentation, application whitelisting, and tested backups.