LockBit Ransomware Recovery: What's Recoverable

LockBit, also known as LockBit 3.0 or LockBit Black, is one of the largest ransomware operations tracked, with a documented history of attacks across thousands of organizations globally since being added to tracking in mid-2022. It maintains extensive, frequently-rotated infrastructure — dozens of historical onion domains alongside currently active leak sites.

LockBit's documented toolkit includes Mimikatz and other credential-theft utilities, Active Directory reconnaissance (AdFind, BloodHound), Cobalt Strike and Metasploit for offensive operations, and — specifically — Veeam credential extraction. That last detail matters: the group doesn't just encrypt production data, it specifically targets the credentials that protect backup infrastructure, aiming to compromise the backup as well as the original.

Because Veeam credentials are a documented target, a LockBit incident calls for checking backup repository integrity independently of production systems — don't assume backups are clean just because the ransom note only mentions encrypted production data. Repository storage and backup files themselves can often still be assessed and partially recovered even where credentials were compromised, provided the underlying files weren't also encrypted or deleted.

In one LockBit 3.0 incident we compared a 1.1 GB file with an unencrypted copy of it, byte by byte. LockBit had encrypted the first 15 MB, then 2.5 MB every 102.5 MB, and appended 266 bytes — the size of an RSA-2048 key block. Only 3.76% of the file was encrypted; the rest was exactly as written.

That is typical of how LockBit 3.0 handles large files, and it is why databases, virtual disks and backups hit by LockBit are worth assessing before anything is written off: what survives depends on what the encrypted regions happened to contain.