# What is LockBit ransomware?

LockBit is a ransomware-as-a-service operation that appeared in 2019 and was the most deployed ransomware variant worldwide in 2022, according to joint advisory AA23-165A, published by CISA, the FBI and international partners on 14 June 2023. Its affiliates got in through exposed remote-desktop services, phishing, stolen credentials and vulnerabilities in internet-facing systems; a separate advisory, AA23-325A of November 2023, described the exploitation of the Citrix Bleed flaw. On 20 February 2024, Operation Cronos, led by the UK's National Crime Agency with the FBI and Europol, took control of LockBit's infrastructure and leak site and obtained more than 1,000 decryption keys. The brand tried to resume afterwards, with far less reach. For defenders, the advisories' lessons still apply: patch edge devices quickly, require MFA on remote access, and watch for lateral movement and large outbound transfers before encryption.

FAQ: [Ransomware groups and families](https://netsenx.com/en/faq/ransomware-families) · https://netsenx.com/en/faq/what-is-lockbit-ransomware

## Read next

- https://netsenx.com/en/detect-ransomware-on-the-network
- https://netsenx.com/en/blog/2026-10-24_ransomware-protection

## Related questions

- [What is ALPHV, also called BlackCat?](https://netsenx.com/en/faq/what-is-alphv-blackcat-ransomware)
- [What is Black Basta ransomware?](https://netsenx.com/en/faq/what-is-black-basta-ransomware)
- [What is Akira ransomware?](https://netsenx.com/en/faq/what-is-akira-ransomware)
- [What is Play ransomware?](https://netsenx.com/en/faq/what-is-play-ransomware)
- [What are Royal and BlackSuit ransomware?](https://netsenx.com/en/faq/what-are-royal-and-blacksuit-ransomware)