: Because so many different actors now use the same underlying code, it is much harder for security researchers to definitively attribute an attack to the original LockBit gang.
The builder was leaked on X (formerly Twitter) by a developer reportedly disgruntled with the LockBit leadership. This made a previously "exclusive" tool available to anyone with an internet connection. Key Components of the Leak LockBit-Black-Builder.zip
The "LockBit Black" (also known as LockBit 3.0) builder is a proprietary tool originally used by the LockBit ransomware-as-a-service (RaaS) gang. It allows users to generate customized ransomware executables, decryptors, and the specialized tools needed to launch an attack. : Because so many different actors now use
: A configuration file where attackers can customize the attack, including: Key Components of the Leak The "LockBit Black"
: Generates the unique encryption keys required for the attack.