LockBit is a ransomware-as-a-service (RaaS) operation: a core group builds the encryptor, the leak site and the payment infrastructure, then rents it to affiliates who do the actual breaking in and extortion, keeping most of the ransom. A LockBit incident is rarely a single sophisticated actor. It is a templated playbook run by whichever affiliate bought access that week, which is why the same entry points and privilege paths show up again and again in UAE enterprise networks.
- LockBit is sold as a kit. The operators writing the encryptor are not the ones in your network.
- Most intrusions start with exposed RDP, an unpatched VPN or firewall appliance, or a phishing lure that drops a broker-sold loader.
- Before any file is encrypted, the affiliate disables endpoint protection, deletes shadow copies, and exfiltrates data for the double extortion threat.
- Segmentation, privileged access control and offline backups stop more incidents than any single detection rule.
Why the affiliate model matters more than the malware
LockBit's code has gone through several major revisions, and a 2024 law enforcement action disrupted a large share of its core infrastructure and leak site. That did not change the business model: a small core group maintains the tooling, and a rotating pool of affiliates does the intrusion work. When one brand is disrupted, the affiliates move to the next kit. The encryptor's name matters less than the intrusion pattern it rides in on, so a defence built around detecting "LockBit" is the wrong frame.
How affiliates actually get in
Three entry paths account for most cases worth studying: an internet-facing remote access service (RDP, an SSL VPN appliance, or a firewall management interface) left exposed with a known, unpatched vulnerability or weak credentials; a phishing email delivering a commodity loader later handed off to a ransomware affiliate; and an initial access broker who already has a foothold from an unrelated compromise and simply sells it. Public-facing VPN and firewall CVEs are a recurring theme in UAE and wider GCC breaches, which is why perimeter appliances deserve the same patch urgency as internet-facing web applications, not the slower internal cycle.
Privilege escalation and lateral movement
Once inside, affiliates rely almost entirely on legitimate admin tools, because that traffic blends into normal activity: PsExec or WMI for remote execution, credential dumping against LSASS, and RMM software repurposed for persistence. Active Directory is the target. A single over-privileged service account or a reused domain admin credential is usually enough to reach domain-wide access. That is exactly the gap privileged access management closes, a common finding where it has not been implemented.
Disabling your defences before the encryption starts
LockBit affiliates do not encrypt into a network with working EDR. They disable it first, using bring-your-own-vulnerable-driver (BYOVD) tools that kill EDR processes with kernel-level privilege, Group Policy pushes that disable Windows Defender or add broad exclusions, and tamper-protection bypass tricks against specific agents. Shadow copies are deleted with vssadmin or wmic so local recovery is not an option, and data is exfiltrated first with dedicated tooling or cloud sync utilities. That exfiltration step, not the encryption, is now the main pressure point: a business that restores from backup and refuses to pay still faces a data exposure decision.
What detection actually looks like
The useful detection window sits before encryption, in the privilege escalation and defence evasion stages: a service account authenticating interactively for the first time, PsExec or WMI activity against multiple hosts in a short window, an EDR agent going offline or a tamper alert firing, mass shadow copy deletion, or an unfamiliar RMM binary on a domain controller. This needs a SIEM actually ingesting endpoint, identity and firewall logs with correlation rules built around these behaviours, and someone in a UAE or GCC SOC watching those alerts outside business hours, since affiliates deliberately trigger encryption on weekends and holidays when response is slowest.
The controls that hold up in practice
Patch internet-facing VPN, firewall and remote access appliances on the same cycle as public web applications. Remove RDP from the internet and put it behind a VPN with multi-factor authentication. Segment the network so a compromised workstation cannot reach every server subnet, and keep domain admin credentials off anything that touches email or the internet. Keep one backup copy offline or immutable and test restoring from it, since an untested backup is a hypothesis, not a control. Deploy EDR with tamper protection enabled and monitored, not just installed. None of this is exotic. It is also, consistently, what is missing when an incident review happens after the fact.
What a VAPT scope for ransomware readiness actually tests
A penetration test aimed at ransomware exposure in UAE and GCC enterprises should map onto this attack chain rather than run a generic scan: perimeter services tested against the same CVE classes affiliates exploit, lateral movement attempted from a standard user foothold to domain admin, backup infrastructure checked for reachability from a compromised workstation account, and EDR tamper protection validated under a real bypass attempt rather than taken on faith. VAPT engagements scoped this way produce findings a board can act on, because each one maps to a step an affiliate would take, not a generic severity score.
Where to put budget first
If only one control gets funded this year, close the privilege escalation path from a standard user account to domain admin. Everything else mostly buys time against an affiliate who already has that access. After that: offline, tested backups; monitored EDR with tamper protection rather than EDR as a checkbox; and a rehearsed incident response plan naming who can authorise isolating a domain controller at 2am without a committee. UAE organisations that recover fastest already knew which switch to flip and who was allowed to flip it. See the ransomware FAQ for the questions boards ask most often once this has happened elsewhere in the sector.
