Security Brief: Millions of Messages Distribute LockBit Black Ransomware

Description

In late April 2024, Proofpoint observed high-volume email campaigns facilitated by the Phorpiex botnet, distributing millions of messages with attachments leading to LockBit Black ransomware infections. The messages appeared to originate from 'Jenny Green' and contained ZIP attachments with executable files that initiated network connections to download and execute the ransomware payload. This campaign marked the first widespread distribution of LockBit Black via the longstanding Phorpiex botnet infrastructure, indicating a notable shift in tactics by threat actors leveraging leaked ransomware builder tools.