A recent cyber incident in West Africa has once again highlighted the persistent threat posed by the LockBit ransomware. Cybercriminals armed with stolen administrator credentials have deployed a customized variant of the encryption malware equipped with self-propagation capabilities.

Despite the exposure of the LockBit 3.0 builder in 2022, attackers continue to actively use it to create customized versions of the ransomware, leveraging its flexibility without requiring advanced programming skills.

This incident underscores a concerning trend where attackers craft sophisticated ransomware capable of spreading autonomously within networks. The identified malware variant exhibits unprecedented features, including impersonation of system administrators and adaptive self-spreading across networks.

By leveraging highly privileged domain credentials, the ransomware can disable security measures, encrypt network shares, and erase event logs to conceal its actions. Each infected host becomes a vector for further infection, amplifying the impact within the victim’s network.

Custom configuration files allow the malware to adapt to specific network environments, enhancing its efficacy and evasiveness. This flexibility, combined with the ease of use of the leaked builder, presents significant challenges for cybersecurity professionals.

Additionally, attackers have been observed using the SessionGopher script to extract saved passwords from affected systems. While incidents lacking some advanced capabilities have been observed in various industries and regions, the geographical scope of attacks may be expanding.

The recent international law enforcement takedown of the LockBit ransomware group highlights the collaborative efforts required to combat such threats.

To mitigate ransomware attacks, Kaspersky recommends implementing frequent backups, deploying robust security solutions, and providing regular cybersecurity training to employees.