Leaked LockBit 3.0 builder used by ‘Bl00dy’ ransomware gang in attacks

Gandalf_The_Grey · Sep 28, 2022

The relatively new Bl00Dy Ransomware Gang has started to use a recently leaked LockBit ransomware builder in attacks against companies.

Last week, the LockBit 3.0 ransomware builder was leaked on Twitter after the LockBit operator had a falling out with his developer. This builder allows anyone to build a fully functional encryptor and decryptor that threat actors can use for attacks.

As the builder includes a configuration file that can easily be customized to use different ransom notes, statistics servers, and features, BleepingComputer predicted that other threat actors would soon use the builder to create their own ransomware.

Unfortunately, our predictions have come true, and a relatively new ransomware group named 'Bl00Dy Ransomware Gang' has already utilized the builder in an attack on a Ukrainian entity.