# New LockBit Green ransomware variant borrows code from Conti ransomware **[securityaffairs.com/141666/cyber-crime/lockbit-green-ransomware-variant.html](https://securityaffairs.com/141666/cyber-crime/lockbit-green-ransomware-variant.html)** February 1, 2023 [February 1, 2023 By Pierluigi Paganini](https://securityaffairs.com/author/paganinip) ## Lockbit ransomware operators have released a new version of their malware, LockBit Green, that also targets cloud-based services. Lockbit ransomware operators have implemented a new version of their malware, dubbed LockBit Green, which was designed to include cloud-based services among its targets. This is the third version of the ransomware developed by the notorious gang, after the Lockbit Red and Lockbit Black ones. Affiliates to the Lockbit RaaS can obtain LockBit Green using the builder feature on the LockBit portal. The release of the new version was confirmed by the vx-underground researchers: ----- Lockbit ransomware group has informed us they have acquired a 3rd ransomware variant. – Lockbit Red – Lockbit Black – Lockbit Green They also have modified their ESXI ransomware variant. [Yes, they actually wrote "TLP:RED" in the image. pic.twitter.com/Oacbl2ZJk7](https://t.co/Oacbl2ZJk7) [— vx-underground (@vxunderground) January 27, 2023](https://twitter.com/vxunderground/status/1618885718839001091?ref_src=twsrc%5Etfw) According to the researchers who analyzed the new version, the operators have modified their ESXI ransomware variant. Antonio Cocomazzi, a senior threat intelligence researcher from SentinelOne, reported that [the new variant has a significant overlap with the Conti ransomware, whose source code was](https://securityaffairs.com/129296/cyber-crime/hacker-leaked-conti-ransomware-source-code.html) leaked months ago. _“I conducted an analysis of the sample and found that it has significant overlap (89%_ _[similarity) with the #Conti Ransomware, specifically its v3 version, which the source code](https://www.linkedin.com/feed/hashtag/?keywords=conti&highlightedUpdateUrns=urn%3Ali%3Aactivity%3A7026291707570700289)_ _has been leaked several months ago. The commandline flags for LockBit Green are identical_ _to those of Conti v3, making it a derivative of the original source code.” explained_ **_Cocomazzi._** The experts pointed out that only a small part of the source code has been modified by LockBit, including the ransom note which is identical to the one used by the LockBit Black variant. The ransom note filename has been changed to “!!!-Restore-My-Files-!!!.txt”. The availability of the source code of other malware allows operators to create their own version, improving it, and speeding up the development lifecycle. _“The approach of reusing and adapting the source code of reputable competitors, such as_ _the now-defunct Conti, helps to lower the cost and time of development allowing_ _the_ _[#RaaS maintainers to maximize their speed of release to attract new affiliates.”](https://www.linkedin.com/feed/hashtag/?keywords=raas&highlightedUpdateUrns=urn%3Ali%3Aactivity%3A7026291707570700289)_ _concludes Cocomazzi._ Prodaft researchers shared Indicators of Compromise for the Lockbit Green variant along with the Yara rule for its pattern detection. ----- ⚠️On January 27, 2023, the LockBit ransomware team made a so-called LockBit Green" version of their ransomware available. The hashes and YARA rule can be [found here: 👉https://t.co/0A9waHAwZj#lockbit](https://t.co/0A9waHAwZj) [#ransomware](https://twitter.com/hashtag/ransomware?src=hash&ref_src=twsrc%5Etfw) — PRODAFT (@PRODAFT) [January 30, 2023](https://twitter.com/PRODAFT/status/1620066347073019905?ref_src=twsrc%5Etfw) **[Pierluigi Paganini](http://www.linkedin.com/pub/pierluigi-paganini/b/742/559)** **[(SecurityAffairs –](http://securityaffairs.co/wordpress/)** **hacking, LockBit green)** [CybercrimeHackinghacking newsinformation security newsIT Information SecurityLockbit](https://securityaffairs.com/tag/cybercrime) [GreenLockBit RansomwaremalwarePierluigi PaganiniSecurity AffairsSecurity News](https://securityaffairs.com/tag/lockbit-ransomware) Share On You might also like ----- **[Google Gmail client-side encryption is available globally](https://securityaffairs.com/142836/security/google-gmail-client-side-encryption.html)** March 1, 2023 By [Pierluigi Paganini](https://securityaffairs.com/author/paganinip) ----- **[Bitdefender released a free decryptor for the MortalKombat Ransomware family](https://securityaffairs.com/142830/malware/mortalkombat-ransomware-free-decryptor.html)** February 28, 2023 By [Pierluigi Paganini](https://securityaffairs.com/author/paganinip) Copyright 2021 Security Affairs by Pierluigi Paganini All Right Reserved. Back to top [Home](https://securityaffairs.com/) [Cyber Crime](https://securityaffairs.com/category/cyber-crime) [Cyber warfare](https://securityaffairs.com/category/cyber-warfare-2) [APT](https://securityaffairs.com/category/apt) [Data Breach](https://securityaffairs.com/category/data-breach) [Deep Web](https://securityaffairs.com/category/deep-web) [Digital ID](https://securityaffairs.com/category/digital-id) [Hacking](https://securityaffairs.com/category/hacking) [Hacktivism](https://securityaffairs.com/category/hacktivism) [Intelligence](https://securityaffairs.com/category/intelligence) [Internet of Things](https://securityaffairs.com/category/iot) [Laws and regulations](https://securityaffairs.com/category/laws-and-regulations) ----- [Malware](https://securityaffairs.com/category/malware) [Mobile](https://securityaffairs.com/category/mobile-2) [Reports](https://securityaffairs.com/category/reports) [Security](https://securityaffairs.com/category/security) [Social Networks](https://securityaffairs.com/category/social-networks) [Terrorism](https://securityaffairs.com/category/terrorism) [ICS-SCADA](https://securityaffairs.com/category/ics-scada) [EXTENDED COOKIE POLICY](https://securityaffairs.com/extended-cookie-policy) [Contact me](https://securityaffairs.com/contact) -----