extortion.wiki THE RANSOMWARE DOCUMENTARY ARCHIVE
Menu

242 negotiations · 332 notes · 276 seizure banners · snapshots Jul 06, 2026 / Jun 26, 2026 / Jul 23, 2026

lockbit3.0

From extortion.wiki, the ransomware negotiation research archive

Negotiation records classified under lockbit3.0 in the current Ransomchats snapshot. This page indexes the source label; it does not independently verify attribution.

Classification follows the source dataset. Metadata is useful. It is not testimony.

Actor lineage

Global lineage directory

Overview

LockBit evolved through multiple named variants and an affiliate-based RaaS program. Operation Cronos disrupted core infrastructure in February 2024; later activity must not be read as proof that every historical affiliate remained connected.

Source name
lockbit3.0
Canonical lineage name
LockBit
Entity model
operation
First observed
January 2020
Last observed
Date not established
Current status
Disrupted

Documentary media

Official FBI wanted poster for Mikhail Pavlovich Matveev with four agency-published photographs
FBI wanted poster for Mikhail Pavlovich MatveevOfficial FBI wanted poster for Mikhail Pavlovich Matveev. The FBI describes him as an alleged ransomware affiliate linked to LockBit and Hive and records federal charges and outstanding warrants; status: wanted as of 23 July 2026.Published identity:Mikhail Pavlovich Matveev · wanted as of 2026-07-23 · official reward record: Up to USD 10,000,000Federal Bureau of Investigation · published 2023-05-16 · Primary evidenceEvidence status:officially confirmed · Rights/review:documentary excerpt reviewedThe FBI policy treats unattributed Bureau information as public information subject to restrictions on the FBI seal, name, and implied endorsement. The complete poster page is shown only as documentary context; the seal is not isolated or used as branding.Federal Bureau of Investigation wanted poster; reproduced as an attributed documentary preview. No FBI endorsement is implied.
2 additional reviewed records
Operation Cronos seizure notice displayed on disrupted LockBit leak-site infrastructure
Operation Cronos LockBit seizure noticeSeizure notice displayed on LockBit leak-site infrastructure during Operation Cronos on 20 February 2024. The UK National Crime Agency published this screenshot with its disruption announcement; it is documentary evidence, not extortion.wiki branding.UK National Crime Agency · captured 2024-02-20 · Primary evidenceEvidence status:officially confirmed · Rights/review:reusable with attributionThe NCA terms permit news-story images to be reproduced for reportage of the associated story with copyright acknowledged. The image is used only to document Operation Cronos; no NCA logo is extracted or used as site branding.Copyright National Crime Agency; reproduced for reportage of the associated Operation Cronos news story.
First page of the official joint advisory Understanding Ransomware Threat Actors LockBit
Joint LockBit evolution advisoryFirst-page preview of the joint LockBit advisory whose evolution table distinguishes ABCD ransomware, LockBit version names, and code similarities.CISA, FBI, MS-ISAC, and international partners · published 2023-06-14 · Contextual materialEvidence status:officially confirmed · Rights/review:documentary excerpt reviewedA low-resolution first-page excerpt is used to identify and discuss the underlying official advisory. Agency marks remain only within the unaltered document preview; no general reuse license is claimed.Source: CISA, FBI, MS-ISAC, and international partners joint advisory AA23-165A.

Known aliases

Evidence-backed names associated with this lineage record
AliasTypeFirst observedLast observedConfidenceSources
lockbit3.0Original Ransomchats collection label retained for historical record identity. Alternate name Date not established Date not established Confirmed Casualtek · CISA, FBI, MS-ISAC, and international partners
LockBit 2.0CISA evolution-table name for the second major LockBit variant; it does not identify every affiliate as the same person or crew. Malware name June 2021 Date not established Confirmed CISA, FBI, MS-ISAC, and international partners
LockBit RedAlternate name for LockBit 2.0 in the joint advisory. Malware name June 2021 Date not established Confirmed CISA, FBI, MS-ISAC, and international partners
LockBit 3.0Third major LockBit variant; the leaked builder later enabled non-LockBit affiliates to deploy it. Malware name March 2022 Date not established Confirmed CISA, FBI, MS-ISAC, and international partners
LockBit BlackAlternate name for LockBit 3.0 in the joint advisory. Malware name March 2022 Date not established Confirmed CISA, FBI, MS-ISAC, and international partners

Historical timeline

Lineage and relationships

Relationships shown from this actor's perspective
Related actor or familyRelationshipPeriodConfidenceEvidence summarySources
Contioperation Code overlapsupported · undirected From January 2023 High confidence

The joint LockBit advisory reports that LockBit Green incorporated Conti ransomware source code. Code reuse is not evidence that the operations shared leadership.

  • CISA's LockBit evolution table records the January 2023 arrival of LockBit Green incorporating Conti source code.
 CISA, FBI, MS-ISAC, and international partners
ABCD ransomwareransomware family Predecessorconfirmed · directed From September 2019 Confirmed

The joint LockBit advisory explicitly calls ABCD ransomware the predecessor to LockBit. This describes ransomware lineage and does not by itself prove uninterrupted operator identity.

  • CISA's LockBit evolution table records ABCD activity in September 2019 and identifies it as the predecessor to LockBit.
 CISA, FBI, MS-ISAC, and international partners

Predecessors

Successors

None established.

Splits and mergers

None established.

Suspected affiliate relationships

None established.

MITRE ATT&CK integration

No explicit MITRE ATT&CK group mapping is published for this source label. Software entries and fuzzy name matches are not promoted to group mappings.

External intelligence references

  1. Casualtek/RansomchatsCasualtek · dataset provenance · context only
  2. Understanding Ransomware Threat Actors: LockBitCISA, FBI, MS-ISAC, and international partners · government advisory · primary authoritative
  3. The NCA announces the disruption of LockBit with Operation CronosUK National Crime Agency · law enforcement · primary authoritative
  4. Mikhail Pavlovich MatveevFederal Bureau of Investigation · law enforcement · primary authoritative
  5. Russian National Charged with Ransomware Attacks Against Critical InfrastructureU.S. Department of Justice · law enforcement · primary authoritative
  6. Terms and ConditionsUK National Crime Agency · publisher terms · context only
  7. Privacy PolicyFederal Bureau of Investigation · publisher terms · context only

Confidence and evidence notes

Confidence applies to each individual alias, event, or relationship—not to the actor page as a whole. “Confirmed” requires explicit authoritative attribution or multiple strong independent sources. Moderate, low, disputed, and unknown entries retain the source's uncertainty. A malware-family name is not automatically an actor identity, and shared code or affiliates do not prove shared leadership.

Ransomware notes

Browse Lockbit notes

The explicit archive alias mapping connects this Ransomchats actor label to the ThreatLabz family Lockbit. Its 5 archived notes are counted and searched separately from the negotiation records below.

Search within this collection

Negotiation records

Filter lockbit3.0 records

Collection: 42 records · 2,209 messages

lockbit3.0 negotiation record collection
Participants Source Archive status
Not recorded **************************149576 17 LockBit 3.0, Victim JSON Indexed
Not recorded Chat: *************83E824 3 LockBit 3.0, Victim JSON Indexed
Not recorded Chat: *************E06EBD 27 LockBit 3.0, Victim JSON Indexed
Not recorded Chat: *************6B2E47 27 LockBit 3.0, Victim JSON Indexed
Not recorded 0E1263992076698458ABCB025007C6FF 42 LockBit 3.0, Victim JSON Indexed
Not recorded Chat: *************E3E6E9 25 LockBit 3.0, Victim JSON Indexed
Not recorded Chat: *************830677 37 LockBit 3.0, Victim JSON Indexed
Not recorded Chat: *************138292 106 LockBit 3.0, Victim JSON Indexed
Not recorded Chat: *************FD63B4 8 LockBit 3.0, Victim JSON Indexed
Not recorded Chat: *************58E425 29 LockBit 3.0, Victim JSON Indexed
Not recorded Chat: *************5571ED 6 LockBit 3.0, Victim JSON Indexed
Not recorded Chat: *************3FB886 34 LockBit 3.0, Victim JSON Indexed
Not recorded Chat: *************D530E1 52 LockBit 3.0, Victim JSON Indexed
Not recorded Chat: *************E1F5B5 27 LockBit 3.0, Victim JSON Indexed
Not recorded Chat: *************AF75A0 8 LockBit 3.0, Victim JSON Indexed
Not recorded Chat: *************7E0E3E 94 LockBit 3.0, Victim JSON Indexed
Not recorded Chat: *************DD3ED9 93 LockBit 3.0, Victim JSON Indexed
Not recorded 124 50 Lockbit3.0, Victim JSON Indexed
Not recorded 154 137 Lockbit3.0, Victim JSON Indexed
Not recorded 206 4 Lockbit3.0, Victim JSON Indexed
Not recorded 36 49 Lockbit3.0, Victim JSON Indexed
Not recorded Chat: *************83E679 43 LockBit 3.0, Victim JSON Indexed
Not recorded Chat: *************C28148 99 LockBit 3.0, Victim JSON Indexed
Not recorded Chat: *************FFFFFF 70 LockBit 3.0, Victim JSON Indexed
Not recorded Chat: *************EDEF83 43 LockBit 3.0, Victim JSON Indexed
Not recorded Chat: *************48F187 56 LockBit 3.0, Victim JSON Indexed
Not recorded Chat: *************6061AC 66 LockBit 3.0, Victim JSON Indexed
Not recorded Chat: *************8FD3F5 28 LockBit 3.0, Victim JSON Indexed
Not recorded Chat: *************A3A3A4 8 LockBit 3.0, Victim JSON Indexed
Not recorded Chat: *************645926 17 LockBit 3.0, Victim JSON Indexed
Not recorded Chat: *************1E97B3 25 LockBit 3.0, Victim JSON Indexed
Not recorded Chat: *************D81BF2 20 LockBit 3.0, Victim JSON Indexed
Not recorded Chat: *************E3E68C 103 LockBit 3.0, Victim JSON Indexed
Not recorded Chat: *************21837D 237 LockBit 3.0, Victim JSON Indexed
Not recorded Chat: *************C0C807 29 LockBit 3.0, Victim JSON Indexed
Not recorded Chat: *************B8DC6D 78 LockBit 3.0, Victim JSON Indexed
Not recorded Chat: *************4E978C 30 LockBit 3.0, Victim JSON Indexed
Not recorded Chat: *************888989 215 LockBit 3.0, Victim JSON Indexed
Not recorded Chat: *************DFC2C5 73 LockBit 3.0, Victim JSON Indexed
Not recorded Chat: *************CED340 21 LockBit 3.0, Victim JSON Indexed
Not recorded Chat: *************89AFE8 39 LockBit 3.0, Victim JSON Indexed
Not recorded Chat: *************7240FE 34 LockBit 3.0, Victim JSON Indexed