LockBit was the most widely used ransomware variant worldwide in 2022 and is still prolific. Since January 2020, LockBit has attacked organizations of various sizes across critical infrastructure sectors, including financial services, food and agriculture, education, energy, government and emergency services, healthcare, manufacturing, and transportation.

The tactics, techniques, and procedures (TTPs) observed in LockBit ransomware attacks vary significantly. This variation in observed ransomware TTPs poses a significant challenge for organizations to maintain network security and protect against the ransomware threat. After Operation Cronos against the LockBit group, there has been a massive increase in attacks to reassert themselves and seek revenge.