LockBit 4.0 Released – Ransomware Group Aimed to Launch Massive Attack Across Multiple OS

Cybercriminal group LockBit has unveiled its latest creation, “LockBit 4.0,” which they have dramatically described as a ‘movie’ set for release soon.

This new version introduces sophisticated tricks to amplify the group’s attacks, presenting a greater challenge for individuals and organizations worldwide.

In a recent darknet post, LockBit revealed its confidence in resuming large-scale operations, boasting enhanced capabilities, new features, and a renewed focus on global ransomware campaigns.

The notorious ransomware group LockBit has officially announced its resurgence with the launch of LockBit 4.0. Following a year of intensified law enforcement crackdowns, the group has signaled a full-scale return.

Along with a statement claiming the release of LockBit 4.0, a comment was posted inviting new affiliates to join.

The affiliate recruitment page states that new members can join instantly by paying a cryptocurrency fee equivalent to approximately $780 at the current exchange rate.

LockBit 4.0 encrypts the victim’s files and appends the extension ” .xa1Xx3AXs ” to each encrypted file name. For example, the file “1.jpg” will appear as “1.jpg.xa1Xx3AXs”. In addition, this ransomware also creates a ransom note named “xa1Xx3AXs.README.txt”, which contains instructions for victims to pay the ransom in order to decrypt their data.

Considering the practice in the industry of carefully selecting affiliates through interviews and document screening to eliminate the risk of undercover investigations by the authorities, as well as the events that followed Operation Cronos in February 2024, this situation seems unnatural and gives a glimpse into the possibility that there may be some underlying circumstances.

What’s New in LockBit 4.0?

Cyber Press Researchers learned from the LockBit 4.0 website that the latest iteration of the LockBit ransomware comes loaded with advancements in several critical areas:

• Enhanced File Encryption: LockBit 4.0 employs more sophisticated encryption techniques, making it harder for victims to recover files.
• Advanced Data Exfiltration: The ransomware is designed to improve the theft of sensitive information before encrypting systems.
• Cross-Platform Capability: LockBit 4.0 can now operate across multiple operating systems, increasing its versatility in targeting diverse environments.
• Randomized File Naming: Encrypted files are renamed with random patterns, making it more difficult for victims to identify and recover their data.
• Self-Deletion Mechanism: The ransomware has a built-in ability to automatically delete its own files post-encryption, further complicating recovery efforts.

These upgrades indicate a significant leap in the ransomware group’s capabilities, underscoring the growing sophistication of cyberattacks in today’s digital landscape.

Mitigation Strategies: How to Stay Safe from LockBit 4.0

To counter the rising threat posed by ransomware like LockBit 4.0, cybersecurity experts have outlined several measures that businesses and individuals must adopt to secure their systems

Here’s the information organized into a clear table format:

Preventive Measure	Description
Regular Backups	Back up critical data frequently and store copies offline to protect them from ransomware attacks.
Update Systems and Software	Keep operating systems, applications, and security tools updated with the latest patches.
Simulate Attacks and Manage Threat Exposure	Conduct Breach and Attack Simulations (BAS) and apply Continuous Threat Exposure Management (CTEM).
Restrict Open Ports and Firewall Rules	Block unnecessary ports, tighten firewall configurations, and minimize attack surfaces.
Avoid Phishing Traps	Be cautious of suspicious emails, links, and attachments to avoid triggering ransomware infections.
Limit External Remote Access (RDP)	Disable or restrict Remote Desktop Protocol (RDP) to reduce external attack risks.
Strengthen User Authentication	Use multi-factor authentication (MFA) to prevent unauthorized access, even with stolen credentials.
Implement EDR/XDR Solutions	Deploy Endpoint Detection and Response (EDR) or Extended Detection and Response (XDR) tools.
Control Admin Access	Limit admin privileges to essential personnel to minimize the impact of potential breaches.

With LockBit 4.0 poised to mark a new chapter in the ransomware saga, cybersecurity remains a priority for all organizations, regardless of size or industry.

The stakes have never been higher, as groups like LockBit continue to innovate in their relentless pursuit of financial gain. Staying proactive, informed, and prepared is the key to outsmarting these adversaries.

For businesses and individuals alike, now is the time to review and strengthen digital defenses.

As the ransomware threat landscape grows increasingly complex, adopting a layered, proactive approach to security is the best safeguard against attacks like LockBit 4.0.