LockBit Ransomware: Timeline, Status and the Attacks We Reported

Where LockBit stands in November 2026

• Active again. LockBit released version 5.0 in September 2025, with lockers for Windows, Linux and VMware ESXi servers. Check Point counted 163 victims posted in the first quarter of 2026, the fourth-highest count of any group, and added that the list may include recycled or invented entries.
• Leader at large. The US and UK named Dmitry Khoroshev, a Russian national from Voronezh, as “LockBitSupp” in May 2024. He faces 26 counts in New Jersey, sanctions in the US, UK and Australia, and a US reward of up to $10 million.
• In court. Affiliates Ruslan Astamirov and Mikhail Vasiliev pleaded guilty in July 2024 and were awaiting sentencing at the Justice Department’s last update in March 2025. Rostislav Panev, the alleged developer, was extradited from Israel that month. Three more men charged in the US (Mikhail Matveev, Artur Sungatov, Ivan Kondratyev) are not in US custody (case list).
• Claims still need checking. In August 2026 LockBit listed US Bank; the bank said the claim related to a “fourth party event” outside its environment.

When a headline says LockBit “hit” a company, read it as LockBit’s claim until the company, a court or a regulator says more. After the 2024 takedown, the UK’s National Crime Agency found the gang’s new leak site inflated its activity with old victims and with attacks carried out using other ransomware.

How LockBit works

LockBit is run as a service. A small core team writes the ransomware, hosts the leak site and the negotiation panel, and recruits “affiliates” who break into networks and run the attacks. According to US prosecutors, the affiliate usually kept 80% of a ransom and Khoroshev took 20%, which they say earned him at least $100 million.

Because hundreds of unrelated affiliates used the same tools, the break-ins vary. A joint advisory by agencies from seven countries lists the usual ways in: unpatched internet-facing systems (Fortinet VPNs, PaperCut, Log4j among them), exposed Remote Desktop, phishing, and stolen or guessed passwords.

Once inside, affiliates copy data out, often with LockBit’s own tool StealBit, then encrypt the network and post the victim on the leak site with a countdown. The advisory notes that leak sites only show victims who refused to pay, and that a post can appear months after the attack. Paying didn’t buy deletion either. Investigators found LockBit kept data from victims who had paid.

The scale is why governments made it a priority. The US Justice Department counts more than 2,500 victims in at least 120 countries and at least $500 million in ransom payments. Our ransomware guide covers how these attacks work in general.

LockBit timeline, 2019–2026

2019–2022

• September 2019: A predecessor called “ABCD” ransomware is first seen.
• January 2020: The LockBit name appears on Russian-language crime forums; the first LockBit activity in the US is recorded on 5 January.
• June 2021: LockBit 2.0 arrives with StealBit, a tool for copying data out of victims’ networks.
• October 2021: A version for Linux and VMware ESXi servers follows.
• March 2022: LockBit 3.0, also called LockBit Black.
• 2022: LockBit becomes the most deployed ransomware in the world. In Canada it accounts for 22% of attributed ransomware incidents that year.
• Late 2022: Affiliate Mikhail Vasiliev is arrested in Canada and charged in the US.

2023

• January: “LockBit Green”, built on leaked code from the Conti gang.
• May and June: US prosecutors charge Mikhail Matveev (May) and arrest Ruslan Astamirov (June).
• 14 June: Agencies from seven countries publish the joint advisory: about 1,700 US attacks and roughly $91 million in US ransom payments since 2020.
• September 2023 to January 2024: LockBit lists the seven organisations in the table below.

2024

• 19–20 February: Operation Cronos. The NCA and the FBI, with police from other countries coordinated by Europol, take over LockBit’s admin system and leak site, obtain its source code and take down 28 affiliate servers. More than 200 crypto accounts are frozen, more than 1,000 decryption keys recovered, and two people arrested in Poland and Ukraine. The US unseals charges against Artur Sungatov and Ivan Kondratyev.
• Late February: LockBitSupp opens a new leak site. Trend Micro later finds that about 68% of its entries were re-uploads of victims attacked before the takedown.
• 7 May: Khoroshev is named as LockBitSupp, charged in New Jersey and sanctioned by the US, UK and Australia. The NCA says 194 affiliates used LockBit until February, and only 69 stayed active after it.
• June: The FBI says it holds more than 7,000 LockBit decryption keys and asks victims to come forward.
• 18 July: Astamirov and Vasiliev plead guilty in Newark.
• October: The NCA reports four more arrests made in August (two in the UK, a suspected developer held at France’s request, an infrastructure provider in Spain) and names Aleksandr Ryzhenkov of the Evil Corp gang as a LockBit affiliate.
• December: US charges against Panev, arrested in Israel in August, are made public.

2025

• 13 March: Panev is extradited to the US. Prosecutors say he was paid about $10,000 a month for development work.
• 7 May: Someone defaces LockBit’s panels with the message “Don’t do crime. CRIME IS BAD xoxo from Prague” and leaks its database. TRM Labs counts about 62,400 bitcoin addresses and more than 4,400 negotiation messages from December 2024 to April 2025.
• September: LockBit 5.0 appears. An analysis by TrendAI finds it gives encrypted files random extensions and stops on systems set to Russian.

2026

• January to March: 163 victims posted, up from 79 in the last quarter of 2025 (Check Point).
• 19 August: US Bank listed with a 14-day deadline; the bank says it found no evidence its own systems were compromised.
• 12 November: We found no arrest, charge or sanction against LockBit members announced in 2026.

The LockBit attacks we reported, checked again

Between September 2023 and January 2024 we published six short reports on LockBit claims. Each relied on one post by FalconFeeds, an account that tracks leak sites, and several repeated LockBit’s claims as fact. On 12 November 2026 we looked for what each organisation, regulators, courts and the press have said since.

Of the seven organisations, only David’s Bridal confirmed an incident on its own systems, and it did so in breach letters sent almost eight months later that don’t name LockBit. Two class actions filed in Pennsylvania in 2024 allege it was LockBit; those are allegations, not findings. ALDO confirmed an incident at a franchise partner, not at ALDO.

For the other five we found no confirmation. That doesn’t prove nothing happened: many companies never announce an attack, and in many countries no law makes them. It means the gang is still the only source. Our January 2024 report said LockBit had “paralyzed” Groupe IDEA; on the day it appeared, the company’s website was working normally.

If your company or your data is affected

If LockBit lists your organisation

• Check before you react. A listing can be old, recycled from another gang, or invented. Look for signs in your own logs and backups before you answer anyone.
• Report it. In the US, the FBI runs a portal for LockBit victims through IC3 (linked from the Justice Department’s case page); elsewhere, your national police cybercrime unit or cyber agency. Law enforcement holds keys and evidence from the 2024 takedown.
• Look for a free key. If files were encrypted with LockBit 3.0, No More Ransom offers a checker that compares your decryption ID with keys police recovered.
• Think hard before paying. The agencies behind the joint advisory advise against it, and LockBit kept data from victims who paid. Khoroshev is sanctioned in the US, UK and Australia, so a payment that reaches him can break sanctions law; get legal advice first.
• Mind the deadlines. Under the GDPR you have 72 hours to tell your data protection authority about a breach that puts people at risk, and US state laws set their own notice rules.

If you get a breach letter

• Read which data the letter lists and accept any free credit monitoring it offers.
• In the US, freeze your credit with Equifax, Experian and TransUnion; it’s free and stops new accounts in your name.
• Expect phishing that mentions the breach, and change any password you reused on that service.
• Don’t go looking for your data on a leak site. It won’t get the data removed, and the sites are run by the people who stole it.

Sources

Government, law enforcement and courts

• Joint advisory “Understanding Ransomware Threat Actors: LockBit” (CISA, FBI, ASD’s ACSC, NCSC-UK and others), June 2023: cyber.gov.au
• NCA, Operation Cronos, 20 February 2024: nationalcrimeagency.gov.uk
• NCA, “LockBit leader unmasked and sanctioned”, 7 May 2024: nationalcrimeagency.gov.uk
• US Justice Department, charges against Khoroshev, 7 May 2024: justice.gov
• US Treasury, sanctions on Khoroshev, 7 May 2024: home.treasury.gov
• US Attorney’s Office, District of New Jersey, LockBit cases: justice.gov; guilty pleas, 18 July 2024: justice.gov; Panev extradition, 13 March 2025: justice.gov
• NCA, Evil Corp and LockBit affiliate, 2 October 2024: NCA newsroom
• David’s Bridal breach letter, filed with the California Attorney General, 13 September 2024: oag.ca.gov; Maine Attorney General filing: maine.gov

Press reports on the incidents

• The Record (ALDO), Cyber Daily (Hanwha) and The Cyber Express (Groupe IDEA), linked in the table. FalconFeeds posts on X for La Prensa, Jasman Automotriz and Contra Costa County (not linked).

Research, attributed in the text

• Check Point, “The State of Ransomware – Q1 2026”; TrendAI, LockBit 5.0 analysis, 25 September 2025; Trend Micro’s April 2024 count of re-uploaded victims; TRM Labs on the May 2025 database leak; The Register on US Bank, 20 August 2026.

About this page

12 November 2026: This page replaces six reports we published between September 2023 and January 2024: “LockBit Ransomware Group Attacks the Hanwha Group and Steals 800GB of Data” (12 Sep 2023), “Lockbit Hits Nicaragua and Canada” (6 Dec 2023), “LockBit Paralyzes Groupe IDEA” (3 Jan 2024), “Lockbit Ransomware Attacks Jasman Automotive in Mexico” (22 Jan 2024), “Lockbit Infiltrates World-Renowned David’s Bridal” (23 Jan 2024) and “LockBit Ransomware Attacks Contra Costa County Employment & Human Services” (28 Jan 2024). Links to them now lead to the matching row of the table above.

Those reports repeated LockBit’s claims from a single social-media post and stated some of them as fact. We corrected four points:

• The 800 GB taken from Hanwha was LockBit’s claim, not an established fact.
• Nothing shows Groupe IDEA’s operations were paralyzed.
• LockBit announced its claims on its own leak site, not on the Exploit forum.
• Authorities advise victims not to pay ransoms, the opposite of what our Contra Costa report said.

Figures on LockBit’s size now come from the US Justice Department and the NCA instead of the estimates in those reports.