Ransomware group profile · #6 by claimed victims

Lockbit2 ransomware

LockBit 2.0 is the second major iteration of the LockBit RaaS platform, launched in mid-2021, introducing automated domain-wide encryption via Active Directory Group Policy and claiming the fastest encryption speed among ransomware families, accounting for 46% of ransomware breach events in early 2022.

Active First seen Sep 2021

1,002Victims claimed on leak sites

0Victims in the last 30 days

0Victims in the last 90 days

43Countries hit

0Leak-site URLs tracked

28 Jun 2022Latest claim recorded

Victimology

Who Lockbit2 claims to have breached, from 1,002 leak-site posts recorded by VULONE.

Claims per month last 12 months

Top sectors

Manufacturing168

Professional Services167

Retail & E-Commerce112

Technology80

Other49

Agriculture and Food Production46

Financial Services39

Government & Defense39

Top countries

Italy29

Germany26

France15

United States14

Canada11

Australia9

Japan8

Mexico8

Latest claimed victims 12 most recent

Victim	Sector	Country	Claimed
datalit.it datalit.it	Technology	IT	28 Jun 2022
oak-brook.org oak-brook.org	Government & Defense	—	26 Jun 2022
ecos-office.com ecos-office.com	Professional Services	—	21 Jun 2022
coteg-azam.fr coteg-azam.fr	Professional Services	FR	21 Jun 2022
sigma-alimentos... sigma-alimentos...	Agriculture and Food Production	—	21 Jun 2022
farmaciacirici.... farmaciacirici....	Healthcare	—	21 Jun 2022
agricolaandrea.... agricolaandrea....	Agriculture and Food Production	—	21 Jun 2022
business.gov.om business.gov.om	Government & Defense	—	20 Jun 2022
builditinc.com builditinc.com	Professional Services	—	20 Jun 2022
rhenus.group rhenus.group	Transportation	—	20 Jun 2022
kuwaitairways.c... kuwaitairways.c...	Transportation	—	20 Jun 2022
plagepalace.com plagepalace.com	Hospitality	—	20 Jun 2022

All 1,002 Lockbit2 victims, searchable

Full victim list with claim posts, domains, timing and exports, plus the negotiation chats and leak-site screenshots VULONE archives for this crew.

Start free Sign in

Tactics, techniques and procedures

ATT&CK technique mapping for Lockbit2 is in progress. Victimology, infrastructure status and leak-site tracking are live above.

Indicators, detections and the full playbook

Hashes, C2 addresses, onion services, Sigma and YARA detections per technique, and the negotiation transcripts are available to signed-in analysts.

See full IOCs

Frequently asked

Is Lockbit2 ransomware still active?

Lockbit2 is tracked as active. The most recent leak-site claim VULONE recorded is dated 28 June 2022.

How many victims has Lockbit2 claimed?

VULONE has recorded 1,002 leak-site victim claims attributed to Lockbit2 since September 2021, across 43 countries and 14 sectors.

Which industries does Lockbit2 target?

The sectors most often named on the Lockbit2 leak site are Manufacturing, Professional Services, Retail & E-Commerce.

Which countries are most affected by Lockbit2?

Most Lockbit2 victims recorded by VULONE are located in Italy, Germany, France.

Where does VULONE get Lockbit2 victim data?

Claims are collected continuously from the group's own leak sites and cross-checked with ransomware.live and RansomLook. A claim is the group's assertion, not a confirmed breach.

Other ransomware groups

Victim claims are collected from leak sites and enrichment partners (ransomware.live, RansomLook) and represent the group's own assertions, not confirmed breaches. Profile last updated 16 September 2026. Questions or corrections: [email protected].