Once Bitten: LockBit Ransomware Case Study

ReliaQuest details a LockBit ransomware intrusion where initial access was gained through a SocGholish infection, Cobalt Strike was staged for C2 and lateral movement, and the adversary ultimately obtained administrator-level credentials to deregister EDR sensors and deploy an encryptor via GPO and PsExec, disabling defenses and deleting recovery artifacts; the report also maps observed MITRE techniques and provides detection/remediation guidance.