PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The FBI’s LockBit 2.0 indicators of compromise (IOCs) are a historical set drawn from malware samples and field analysis available in February 2022—not a current or exhaustive threat feed. The FBI described an affiliate-driven ransomware operation, listed host and network artifacts, and urged organizations to verify indicators in context, strengthen defenses, and report suspected incidents whether or not they pay a ransom.
What the FBI reported about LockBit 2.0
FBI Flash CU-000162-MW is dated February 4, 2022; CISA recorded its public release on February 7, 2022. The FBI described LockBit 2.0 as ransomware-as-a-service (RaaS), in which affiliates carried out intrusions using the LockBit platform. The report said attackers could gain access through purchased network access, unpatched vulnerabilities, insider access, or zero-day exploits.
After entry, attackers could escalate privileges using tools such as Mimikatz, exfiltrate data with public and custom tools, and encrypt files. Ransom notes provided decryption instructions and threatened to publish stolen data on a LockBit leak site. The FBI also reported that a July 2021 update enabled automatic encryption across Windows domains by abusing Active Directory Group Policy, that LockBit recruited insiders in August 2021, and that Linux malware took advantage of VMware ESXi vulnerabilities. These are details reported in the 2022 Flash, not a description of current capabilities.
Recommended Free Tools
What indicators the Flash includes—and what they mean
The Flash lists artifacts observed in its analysis, including commands used to delete shadow copies and logs, registry keys, filenames and extensions, Group Policy changes associated with disabling Windows Defender, a PowerShell command to update Group Policy, decoded IP addresses, a Stealbit URL example, an HTTP PUT pattern, and a named pipe.
These are clues for investigation, not standalone proof of an intrusion. The FBI cautioned that the broader information-security context matters and that some indicators—particularly filenames and IP addresses—may be ephemeral or nondeterministic. A match may have a benign explanation; no match does not rule out activity. The indicators and malware characteristics reflect the FBI’s field analysis and samples as of February 2022. Correlate any match with current endpoint, identity, and network logs and up-to-date threat intelligence before taking action.
A later joint advisory from CISA and international partners, published June 14, 2023, discusses LockBit as a RaaS and describes version evolution and affiliate variation. Treat the February 2022 IOC set as specific to its date and LockBit 2.0 reporting; do not assume it covers later versions or activity.
Rank #2
How to check for possible LockBit activity
- Preserve evidence. Record when and where the suspicious activity appeared, which systems and accounts are involved, and the relevant endpoint, authentication, firewall, VPN, and other boundary logs. Avoid treating an isolated filename, IP address, or other IOC as a verdict.
- Correlate host and network evidence. Compare observed behavior with the artifact types in the Flash—such as suspicious commands, Group Policy changes, unexpected connections, or signs of lateral movement—and examine surrounding events for a coherent sequence.
- Investigate scope and contain carefully. Review unusual account use, administrative access, and connections between systems. Follow your incident-response procedures to limit further spread while preserving evidence and keeping essential systems safe.
- Escalate and report. Contact your security team or incident-response provider as appropriate, and report suspected ransomware activity to the FBI as described below. Use current threat intelligence for operational decisions rather than relying on the 2022 list alone.
Defenses the FBI recommended
Reduce opportunities for access
- Use unique, strong passwords for password-based accounts and enable multifactor authentication where possible, especially for webmail, VPNs, and accounts that access critical systems.
- Keep software up to date and prioritize known exploited vulnerabilities.
- Limit administrative shares and restrict SMB access to those shares. Protect critical Windows files.
- Grant privileged administrative access only when needed, using time-based permissions.
- Disable command-line and scripting permissions where operationally feasible.
Improve detection and contain spread
- Segment networks to limit movement between systems.
- Monitor for abnormal activity and investigate signs of lateral movement.
- Use endpoint detection and response (EDR) to identify unusual host connections.
Prepare to recover
- Maintain offline backups, and regularly practice restoring from them.
- Ensure backups are encrypted and immutable, and cover the organization’s data infrastructure.
Reporting a suspected incident
The FBI urged victims to contact their local FBI field office and/or submit a complaint to IC3, regardless of whether they decide to pay. The Flash stated that payment does not guarantee recovery of files. When available, include the incident date, time, and location; activity type; number of people affected; equipment involved; organization name; and a point of contact.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →The FBI also requested relevant evidence, such as boundary logs, a sample ransom note, communications with the actors, Bitcoin wallet details, decryptor files, and/or a benign sample of an encrypted file. Preserve materials according to your incident-response process and provide them through the appropriate reporting channel.
Quick Recap
Best Value
Rank #3
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
