Unpicking LockBit — 22 Cases of Affiliate Tradecraft

Secureworks outlines how the GOLD MYSTIC group operated the LockBit RaaS since 2019, compromising thousands of organizations and employing varied TTPs such as manual and domain controller–driven ransomware deployment, data-theft extortion without encryption, and targeting VMware ESXi environments; it also notes copycats using the LockBit brand. The brief references the Feb 19, 2024 international law-enforcement disruption led by the UK NCA and US FBI against LockBit infrastructure and links to the full Secureworks report.