Find related topics. | Discover entities. | See connections. | Build a topical map.
Building topical map: Starting…
LockBit: History, Description & Overview
LockBit is a cybercriminal group proposing ransomware as a service (RaaS). Software developed by the group (also called ransomware) enables malicious actors who are willing to pay for using it to carry out attacks in two tactics where they not only encrypt the victim's data and demand payment of a ransom, but also threaten to leak it publicly if their…
Use the mouse wheel or two fingers (on touchscreens) to zoom in and out of the map.
More settings
LockBit topic overview
The analysis highlights History, Description and Overview as prominent areas in the source structure around LockBit.
Related topics
94
Source areas
3
Connected nodes
97
Extracted relationships
101
Concept neighborhoods
14
Bridge connections
97
What this topic covers Research coverage
Source areas are shown by the number of related topics found in each part of the analysis. Use smaller areas too: they can reveal specialized angles and content gaps.
History · 52 topics
Description · 32 topics
Overview · 10 topics
Smaller areas are not necessarily less important. They contain fewer connections in this analysis and can be useful for finding specialized angles or coverage gaps.
Key facts & relationships
High-confidence facts extracted from structured source data. Use them as anchors for further research.
Formation
2019
Type
Cybercrime
Explore all related topics Closing gaps
A structured outline of related entities, concepts and subtopics. Open any item to build a new map centered on it.
Browse the complete topic structure, not only the most central items. Less prominent entities and concepts can reveal missing angles, specialized context and useful research gaps. Each item opens a new analysis centered on that subject.
Deeper signals for content research, entity SEO and topical coverage. The plain-language headings explain what each technical view is useful for.
How LockBit connects Entity context
Entity context groups extracted connections by relationship type. Counts show recurrence in the analyzed source; the examples are research signals, not claims about importance.
The extracted context around LockBit shows recurring relationship patterns in the source. For example, LockBit → According, After, An, Bitcoin, BTC, Director General, Europol, Graeme Biggar, Law, National Crime Agency, No More Ransom, On February, One, Operation Cronos, PHP, Poland, Two Russians, Ukraine, United States, USD Another extracted example is LockBit → Among, Beyond, Continental, German, Group's, In, In August, In November, Indeed, IT, June, Notably, They, US, Volkswagen. Use these groups to spot repeated connection types before inspecting the individual relationships.
LockBit
Top relations
related to Seizure by law enforcement in 2024· 20
LockBit → According, After, An, Bitcoin, BTC, Director General, Europol, Graeme Biggar, Law, National Crime Agency, No More Ransom, On February, One, Operation Cronos, PHP, Poland, Two Russians, Ukraine, United States, USD
related to LockBit 3.0· 15
LockBit → Among, Beyond, Continental, German, Group's, In, In August, In November, Indeed, IT, June, Notably, They, US, Volkswagen
related to Techniques and tactics· 15
LockBit → Advanced Port Scanner, CVE-2018-13379, Fortinet VPNs, GMER, Initial, It, Microsoft Windows, Mimikatz, Once, PowerShell, PowerShell Empire, Process Hacker, RDP, Remote Desktop Protocol, VPN
related to Post-seizure activity· 12
LockBit → As, Dmitry Khoroshev, Donald Trump, FBI, February, Fulton County, Georgia, March, May, On, The, There
related to Description· 10
LockBit → Demands, Linux, Linux-ESXI Locker, LockBit-NG-Dev, NET, StealBit, This, To, VMware ESXi, While
related to LockBit-NG-Dev (LockBit 4?)· 6
LockBit → February, In December, LockBit-NG-Dev, The, Trend Micro, When
related to LockBit 2.0· 3
LockBit → Accenture, In January, Thales
Formation· 1
LockBit → 2019
Type· 1
LockBit → Cybercrime
is a· 1
LockBit → cybercriminal group proposing ransomware as a service
Important terminology
Frequent words and multi-word phrases across the lead, headings, infobox and body. Useful for terminology coverage.
Use these terms to understand the vocabulary surrounding the topic, not as a checklist for keyword stuffing.
Relationships are represented as Subject → Predicate → Object triples. Confidence describes extraction strength, not the real-world importance of a relationship; lower-confidence rows may be contextual rather than explicit.
TTTA extracted 101 structured relationships around LockBit. Examples in this analysis include LockBit → Formation → 2019 and LockBit → Type → Cybercrime. The table shows each extracted connection, where it came from and its confidence.
Subject
Predicate
Object
Confidence
Src
LockBit
Formation
2019
1.00
infobox
LockBit
Type
Cybercrime
1.00
infobox
LockBit
is a
cybercriminal group proposing ransomware as a service
0.90
text
CVE-2018-13379 in Fortinet VPNs.Once installed
instance of
and exploiting vulnerabilities
0.80
text
LockBit ransomware is often executed in Microsoft Windows via command-line arguments
instance of
and exploiting vulnerabilities
0.80
text
scheduled tasks
instance of
and exploiting vulnerabilities
0.80
text
or PowerShell scripts such as PowerShell Empire
instance of
and exploiting vulnerabilities
0.80
text
Mimikatz
instance of
LockBit uses tools
0.80
text
GMER
instance of
LockBit uses tools
0.80
text
Process Hacker
instance of
LockBit uses tools
0.80
text
and registry edits to gather credentials
instance of
LockBit uses tools
0.80
text
disable security products
instance of
LockBit uses tools
0.80
text
No triples extracted yet.
Related concept clusters Concept neighborhoods
Concept neighborhoods group terms that sit near one another in the extracted graph. They are useful for discovering adjacent language and context, but proximity does not by itself imply a factual relationship.
The concept neighborhoods around LockBit bring nearby vocabulary together. In this analysis, examples include Ransomware, Data and Ransom. Use the clusters to find adjacent concepts and terminology that may deserve separate research.
LockBit
Ransomware
Data
Ransom
Attack
May
Claimed
According
November
Enforcement
Law
Attacks
Million
lockbit
Ransomware
Data
Ransom
Attack
May
Claimed
According
November
Enforcement
Law
Attacks
Million
ransom
Paid
Million
Us
According
Enforcement
Law
Victims
Hacker
Ransomware
January
Used
Information
data breach
Stolen
Ransom
Lockbit
Group
Demand
Information
November
Hacker
Claimed
Access
Paid
Using
group policy
Hacker
Claimed
Ransomware
Lockbit
Responsibility
Attack
Data
Demand
Attacked
Ransom
Attacks
Files
brl group
Hacker
Claimed
Ransomware
Lockbit
Responsibility
Attack
Data
Demand
Attacked
Ransom
Attacks
Files
data exfiltration
Stolen
Ransom
Lockbit
Group
Demand
Information
November
Hacker
Claimed
Access
Paid
Using
ransomware as a service
States
United
Reported
According
Used
February
Infrastructure
Ransom
Attack
Us
Using
November
Connections between topic areas Semantic bridges
Semantic bridges connect parts of the graph that would otherwise be more separate. A bridge is a structural signal in this analysis, not a claim that the two topic areas are equivalent.
For LockBit, one of the stronger structural bridges in this analysis connects LockBit with History. Bridges highlight paths between different parts of the map and can reveal research angles that are easy to miss in a flat list.
Number of nodes, edges, triples, density and central hubs. Use it to gauge the size and connectivity of the map.
LockBit
Nodes98
Edges97
Triples101
Avg. degree1.98
Density0.020408
Components1
Source & methodology
TTTA analyzes the structure around LockBit to surface related topics, entities, relationships, concept neighborhoods and bridge connections. Use the map to explore areas such as History, Description & Overview, including less central topics that may reveal useful research gaps. Automatically extracted connections are research leads rather than rewritten encyclopedia content.
