Ransomware Attack On IL&FS: Impact And Mitigation Strategies

**Executive summary:** Cyble reports that the LockBit ransomware group claimed compromise of Infrastructure Leasing & Financial Services Limited (IL&FS) on 28 Feb 2023, posting leaked documents and screenshots and threatening deletion as part of triple-extortion; the report analyzes leaked samples attributed to the LockBit Green variant, lists multiple MD5/SHA1/SHA256 IoCs, contextualizes LockBit’s broader targeting and sectoral impact, and provides mitigation and post-incident guidance.