LockBit2IPIOC.csv

IndicatorType,IndicatorValue,ExpirationTime,Action,Severity,Title,Description,RecommendedActions,Scope/DeviceGroups,Category,MitreTechniques,GenerateAlert
IpAddress,139.60.160.200,,Block,Informational,LockBit 2.0 IP IOC,"LockBit 2.0 operates as an affiliate-based Ransomware-as-a-Service (RaaS) and employs a wide variety of tactics, techniques, and procedures (TTPs), creating significant challenges for defense and mitigation. LockBit 2.0 ransomware compromises victim networks through a variety of techniques, including, but not limited to, purchased access, unpatched vulnerabilities, insider access, and zero day exploits.",Exection blocked. No action required.,,Ransomware,,FALSE
IpAddress,93.190.139.223,,Block,Informational,Andariel-Lazarus Group APT IOC,"LockBit 2.0 operates as an affiliate-based Ransomware-as-a-Service (RaaS) and employs a wide variety of tactics, techniques, and procedures (TTPs), creating significant challenges for defense and mitigation. LockBit 2.0 ransomware compromises victim networks through a variety of techniques, including, but not limited to, purchased access, unpatched vulnerabilities, insider access, and zero day exploits.",Exection blocked. No action required.,,Ransomware,,FALSE
IpAddress,45.227.255.190,,Block,Informational,Andariel-Lazarus Group APT IOC,"LockBit 2.0 operates as an affiliate-based Ransomware-as-a-Service (RaaS) and employs a wide variety of tactics, techniques, and procedures (TTPs), creating significant challenges for defense and mitigation. LockBit 2.0 ransomware compromises victim networks through a variety of techniques, including, but not limited to, purchased access, unpatched vulnerabilities, insider access, and zero day exploits.",Exection blocked. No action required.,,Ransomware,,FALSE
IpAddress,193.162.143.218,,Block,Informational,Andariel-Lazarus Group APT IOC,"LockBit 2.0 operates as an affiliate-based Ransomware-as-a-Service (RaaS) and employs a wide variety of tactics, techniques, and procedures (TTPs), creating significant challenges for defense and mitigation. LockBit 2.0 ransomware compromises victim networks through a variety of techniques, including, but not limited to, purchased access, unpatched vulnerabilities, insider access, and zero day exploits.",Exection blocked. No action required.,,Ransomware,,FALSE
IpAddress,168.100.11.72,,Block,Informational,Andariel-Lazarus Group APT IOC,"LockBit 2.0 operates as an affiliate-based Ransomware-as-a-Service (RaaS) and employs a wide variety of tactics, techniques, and procedures (TTPs), creating significant challenges for defense and mitigation. LockBit 2.0 ransomware compromises victim networks through a variety of techniques, including, but not limited to, purchased access, unpatched vulnerabilities, insider access, and zero day exploits.",Exection blocked. No action required.,,Ransomware,,FALSE
IpAddress,93.190.143.101,,Block,Informational,Andariel-Lazarus Group APT IOC,"LockBit 2.0 operates as an affiliate-based Ransomware-as-a-Service (RaaS) and employs a wide variety of tactics, techniques, and procedures (TTPs), creating significant challenges for defense and mitigation. LockBit 2.0 ransomware compromises victim networks through a variety of techniques, including, but not limited to, purchased access, unpatched vulnerabilities, insider access, and zero day exploits.",Exection blocked. No action required.,,Ransomware,,FALSE
IpAddress,88.80.147.102,,Block,Informational,Andariel-Lazarus Group APT IOC,"LockBit 2.0 operates as an affiliate-based Ransomware-as-a-Service (RaaS) and employs a wide variety of tactics, techniques, and procedures (TTPs), creating significant challenges for defense and mitigation. LockBit 2.0 ransomware compromises victim networks through a variety of techniques, including, but not limited to, purchased access, unpatched vulnerabilities, insider access, and zero day exploits.",Exection blocked. No action required.,,Ransomware,,FALSE
IpAddress,193.38.235.234,,Block,Informational,Andariel-Lazarus Group APT IOC,"LockBit 2.0 operates as an affiliate-based Ransomware-as-a-Service (RaaS) and employs a wide variety of tactics, techniques, and procedures (TTPs), creating significant challenges for defense and mitigation. LockBit 2.0 ransomware compromises victim networks through a variety of techniques, including, but not limited to, purchased access, unpatched vulnerabilities, insider access, and zero day exploits.",Exection blocked. No action required.,,Ransomware,,FALSE
IpAddress,174.138.62.35,,Block,Informational,Andariel-Lazarus Group APT IOC,"LockBit 2.0 operates as an affiliate-based Ransomware-as-a-Service (RaaS) and employs a wide variety of tactics, techniques, and procedures (TTPs), creating significant challenges for defense and mitigation. LockBit 2.0 ransomware compromises victim networks through a variety of techniques, including, but not limited to, purchased access, unpatched vulnerabilities, insider access, and zero day exploits.",Exection blocked. No action required.,,Ransomware,,FALSE
IpAddress,185.215.113.39,,Block,Informational,Andariel-Lazarus Group APT IOC,"LockBit 2.0 operates as an affiliate-based Ransomware-as-a-Service (RaaS) and employs a wide variety of tactics, techniques, and procedures (TTPs), creating significant challenges for defense and mitigation. LockBit 2.0 ransomware compromises victim networks through a variety of techniques, including, but not limited to, purchased access, unpatched vulnerabilities, insider access, and zero day exploits.",Exection blocked. No action required.,,Ransomware,,FALSE
IpAddress,185.182.193.120,,Block,Informational,Andariel-Lazarus Group APT IOC,"LockBit 2.0 operates as an affiliate-based Ransomware-as-a-Service (RaaS) and employs a wide variety of tactics, techniques, and procedures (TTPs), creating significant challenges for defense and mitigation. LockBit 2.0 ransomware compromises victim networks through a variety of techniques, including, but not limited to, purchased access, unpatched vulnerabilities, insider access, and zero day exploits.",Exection blocked. No action required.,,Ransomware,,FALSE