How to remove LockBit ransomware

LockBit ransomware – malicious program that encrypts and leaks corporate data to public

LockBit ransomware – a virus that is borrowing tricks from other threats like REvil and Maze, so it can take ransomware attacks to the next level. Cybercriminals behind the malware use double extortion techniques to make victims pay the ransom. First, the attackers breach the company's network and begin gathering private corporate data, such as company plans, employee/customer details, private contacts, etc. Only then do the attackers deploy the LockBit virus on the network. According to reports,^[1] malware is mostly striking targets in the US, the UK, France, Germany, Ukraine, China, India, and Indonesia.

Initially stemming from LockerGoga family, ransomware has also some similarities to ABCD ransomware. First spotted in October 2019, malware is still active and has already delivered several variants – some using .abcd file extension, while others – .lockbit. It locks documents, databases, pictures, videos, and other files with the help of a combination of AES and RSA ciphers, which makes it extremely difficult to recover data when no backups are available.

After the data locking process, LockBit ransomware also delivers a message from the attackers – it is compiled into a Restore-My-Files.txt file. Inside, it is explained that victims have to contact actors via goodmen@countermail.com, supportpc@cock.li, recoverymanager@cock.li, or another email to negotiate the price of the LockBit ransomware decryptor (in some variants, users are directed to a Tor website such as lockbitks2tvnmwk.onion instead). 

LockBit is known to employ a tactic called Big Game Hunting, which is used by many ransomware families. Just as LockerGoga, it's main targets include cities, high-profile corporations, as well as small businesses. The technique is so effective because larger organizations are more likely to pay a ransom without suffering major losses. Besides, the sums that are asked are adequately increased – the bigger the company, the more money the attackers can ask for.

Similarities with its predecessors do not end there, however. Before executing the infection, LockBit ransomware checks the keyboard language, and exists without causing any harm if the computer owner comes from CIS countries,^[2] including:

• Russia
• Moldova
• Armenia
• Belarus
• Tajikistan
• Ukraine 
• Georgia, and others.

Since the LockBit virus stems from an already established malware family, it uses a variety of techniques in order to access the system. For example, a known malware executable sh1.exe had a valid certificate, which also allowed it to bypass built-in Windows UAC (Windows Account Control) protection. Additionally, LockBit ransomware also deletes Shadow Volume Copies, disables the startup repair function, and performs other Windows changes in order to cause maximum damage, increasing the chances of victims paying the ransom.

According to information provided by VirusTotal,^[3] LockBit ransomware's infectious executables can be detected by many anti-virus engines. Nevertheless, because malware has multiple variants, new releases might not initially be stoppable, even with the most recent version of security software. As a result, LockBit ransomware can access machines even with security programs enabled, so extreme caution should be practiced when dealing with unsolicited emails, establishing a Remote Desktop connection, etc.

LockBit ransomware supposedly includes another module that allows scanning the entire system for new files to encrypt once in a while (for example, every half an hour). This way the cyber threat ensures that no valuable data has been left free from encryption and increases its luck in receiving ransom payments. This is one of the main reasons why LockBit ransomware removal is so important.

After encrypting data, LockBit ransomware will intensively ask for a ransom via a text message placed on the system. Criminals claim that, by using recovery tools, users may permanently damage the locked data and the only way to recover it is by paying the ransom:

All your important files are encrypted!
There is only one way to get your files back:
1. Contact with us
2. Send us 1 any encrypted your file and your personal key
3. We will decrypt 1 file for test(maximum file size – 1 MB), its guarantee what we can decrypt your files
4. Pay
5. We send for you decryptor software

We accept Bitcoin

Attention!
Do not rename encrypted files.
Do not try to decrypt using third party software, it may cause permanent data loss.
Decryption of your files with the help of third parties may cause increased price(they add their fee to our)

Contact information: goodmen@countermail.com

Be sure to duplicate your message on the e-mail: goodmen@cock.li

Your personal id:
–

LockBit ransomware supposedly keeps both encryption and decryption keys safely hidden on remote servers that are reachable only for the criminals themselves. This way, hackers decrease the victims' chances of recovering their data. However, we still do not recommend fulfilling the ransom demands, as LockBit virus developers might simply ignore requests after the payment is completed.

Besides encrypting data and providing ransom demands, LockBit ransomware might be capable of delivering other malware to the Windows computer system. It is not surprising for this to happen as malware sometimes comes in packages. For example, the notorious Djvu ransomware was known to be bundled with AZORult banking trojan.

LockBit ransomware removal is the best way to avoid the risk of additional infections. You should scan your computer system with reliable anti-malware software and get rid of the threat. Afterward, if you have found some damaged components on your system, try repairing them with a tool such as FortectIntego.

After you remove LockBit ransomware from your machine, you can start thinking about possible data recovery solutions. Since malware targets corporations, ransom demands can be exceptionally high (for example, PwndLocker authors asked as much as $660,000 from one of the affected companies). Scroll to the end of the page where you will find some file restoring possibilities which might be helpful in your case.

LockBit ransomware gang: attackers merely take 5 minutes to encrypt the corporate network

Security researchers said that LockBit actors were actively collaborating with the Maze gang, which has been recently shut down.^[4] It was reported that Maze's leak site was initially used to publish sensitive corporate data stolen by criminals, although, in September 2020, a separate website was created for the purpose.

Security researchers from Sophos^[5] analyzed eight incidents connected to this malware strain and discovered that the infection routine is quite sophisticated and very fast. Unlike many other high-profile actors, LockBit uses automated tools in order to break into the targeted networks, although targets are carefully chosen by criminals themselves.

It was reported that cybercriminals use techniques that provide very little forensic information for investigators, as the malicious data resides in memory rather than physical drive. LockBit virus also attempts to bypass Windows 10 built-in anti-malware by applying patches to it via computer memory. Once malware breaks in, it can self-spread across the network and encrypt the most important company information. According to the report, the whole process only takes 5 minutes.

Ransomware infection methods being polished over time

As long as ransomware^[6] has been spread, these malicious parasites are distributed by using the same techniques, although they are also improved with new innovations. According to security specialists from NoVirus.uk,^[7] criminals use email spam as a way to distribute malware. The virus is often hidden in a hyperlink or attachment that comes looking like an ordinary shipping message from a reliable company such as DHL or FedEx.

The most important part about managing your received email is checking the sender, his/her email address, and searching the written texts for possible grammar mistakes. If the message comes from an unidentifiable deliverer or includes a lot of mistakes, you should delete it right away without even considering to open it. Also, scan all received attachments with reliable antimalware software in case the clipped document appears to be malware-laden.

Additionally, ransomware infections can get delivered via other sources such as p2p networks^[8] (The Pirate Bay, eMule) that include a lot of software cracks. Also, malware camouflages as fake software updates (JavaScript, Flash Player), so better get all required program upgrades only from their official websites. Last but not least, vulnerable RDPs that do not include passwords or include weak ones are also targets of cybercriminals. 

LockBit ransomware removal guidelines

LockBit ransomware removal should be carried out only with anti-malware software, otherwise, big damage can be brought to your computer system or you might skip some crucial steps. However, you should disable malicious processes first so that the malware does not interrupt your elimination process.

You can disable LockBit ransomware processes by booting your computer system in Safe Mode with Networking or activating the System Restore feature. If you do not know how to accomplish such tasks, scroll to the end of this article and take a look at the steps provided there.

When you are ready to remove LockBit ransomware from your Windows system, make sure to check the entire machine for malicious strings. You can do that by running a full checkup with SpyHunterCombo Cleaner or MalwarebytesMalwarebytes. If these antivirus programs find some corrupted components, try fixing the damage with FortectIntego software.