{
	"id": "7d3cd35a-0edf-4414-9727-45d3887af230",
	"created_at": "2026-04-06T00:08:13.805494Z",
	"updated_at": "2026-04-10T03:20:21.505697Z",
	"deleted_at": null,
	"sha1_hash": "4736677383c4d8daa520852e3db8974862c9b447",
	"title": "LockBit Green ransomware variant borrows code from Conti one",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 108328,
	"plain_text": "LockBit Green ransomware variant borrows code from Conti one\r\nBy Pierluigi Paganini\r\nPublished: 2023-02-01 · Archived: 2026-04-05 12:57:49 UTC\r\n Pierluigi Paganini February 01, 2023\r\nLockbit ransomware operators have released a new version of their malware,\r\nLockBit Green, that also targets cloud-based services.\r\nLockbit ransomware operators have implemented a new version of their malware, dubbed LockBit Green, which\r\nwas designed to include cloud-based services among its targets.\r\nThis is the third version of the ransomware developed by the notorious gang, after the Lockbit Red and Lockbit\r\nBlack ones. Affiliates to the Lockbit RaaS can obtain LockBit Green using the builder feature on the LockBit\r\nportal.\r\nThe release of the new version was confirmed by the vx-underground researchers:\r\nhttps://securityaffairs.com/141666/cyber-crime/lockbit-green-ransomware-variant.html\r\nPage 1 of 2\n\nAccording to the researchers who analyzed the new version, the operators have modified their ESXI ransomware\r\nvariant.\r\nAntonio Cocomazzi, a senior threat intelligence researcher from SentinelOne, reported that the new variant has a\r\nsignificant overlap with the Conti ransomware, whose source code was leaked months ago.\r\n“I conducted an analysis of the sample and found that it has significant overlap (89% similarity) with\r\nthe #Conti Ransomware, specifically its v3 version, which the source code has been leaked several months ago.\r\nThe commandline flags for LockBit Green are identical to those of Conti v3, making it a derivative of the original\r\nsource code.” explained Cocomazzi.\r\nThe experts pointed out that only a small part of the source code has been modified by LockBit, including the\r\nransom note which is identical to the one used by the LockBit Black variant.\r\nThe ransom note filename has been changed to “!!!-Restore-My-Files-!!!.txt”.\r\nThe availability of the source code of other malware allows operators to create their own version, improving it,\r\nand speeding up the development lifecycle.\r\n“The approach of reusing and adapting the source code of reputable competitors, such as the now-defunct Conti,\r\nhelps to lower the cost and time of development allowing the #RaaS maintainers to maximize their speed of\r\nrelease to attract new affiliates.” concludes Cocomazzi.\r\nProdaft researchers shared Indicators of Compromise for the Lockbit Green variant along with the Yara rule for its\r\npattern detection.\r\nFollow me on Twitter: @securityaffairs and Facebook and Mastodon\r\nPierluigi Paganini\r\n(SecurityAffairs – hacking, LockBit green)\r\nSource: https://securityaffairs.com/141666/cyber-crime/lockbit-green-ransomware-variant.html\r\nhttps://securityaffairs.com/141666/cyber-crime/lockbit-green-ransomware-variant.html\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"Malpedia"
	],
	"references": [
		"https://securityaffairs.com/141666/cyber-crime/lockbit-green-ransomware-variant.html"
	],
	"report_names": [
		"lockbit-green-ransomware-variant.html"
	],
	"threat_actors": [],
	"ts_created_at": 1775434093,
	"ts_updated_at": 1775791221,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/4736677383c4d8daa520852e3db8974862c9b447.pdf",
		"text": "https://archive.orkl.eu/4736677383c4d8daa520852e3db8974862c9b447.txt",
		"img": "https://archive.orkl.eu/4736677383c4d8daa520852e3db8974862c9b447.jpg"
	}
}