LockBit / RaaS Affiliate — Adversary Emulation Playbook

Tier-2 ransomware-affiliate kill chain. Modeled on LockBit (most prolific RaaS of 2022-2023, disrupted by Operation Cronos in Feb 2024) but written as the generic double-extortion template — swap actor_name/group_id to retarget ALPHV/BlackCat, Akira, or Black Basta. The flow: cheap initial access (broker/edge/RDP) → AD compromise to Domain Admin → disable defenses + delete backups → bulk exfil → encrypt Windows + ESXi. Encryption and recovery sabotage are canary/lab-only. Authorized red-team emulation only.

When to emulate a RaaS affiliate

• The client's top concern is ransomware resilience: time-to-Domain-Admin, EDR survival, backup/shadow-copy protection, ESXi exposure, and exfil detection.
• Any sector — RaaS is opportunistic and cross-industry (see the industry → actor map in ../../references/apt-groups.md).

ThreatProfile seed (plan/threat-profile.json)

{
  "engagement_name": "<fill>",
  "actor_name": "LockBit-like (RaaS affiliate)",
  "actor_aliases": ["LockBit 3.0 / Black", "RaaS affiliate", "(retarget: ALPHV / Akira / Black Basta)"],
  "group_id": "",
  "tier": "tier-2",
  "sophistication": "high",
  "motivation": "financial",
  "initial_access": ["T1190", "T1133", "T1566", "T1078"],
  "key_ttps": ["T1059.001", "T1003.001", "T1558.003", "T1484.001", "T1562.001", "T1490", "T1021.001", "T1567.002", "T1486"],
  "tools": ["Initial-access-broker creds", "Sliver / Cobalt-style beacon", "NetExec", "Impacket / PsExec", "rclone (exfil)", "canary encryptor (lab)"],
  "infrastructure": ["RDP/VPN edge foothold", "GPO-based deployment", "Engagement-owned exfil bucket"],
  "recent_cti_delta": "LockBit: StealBit/MEGA exfil, Windows + VMware ESXi lockers, GPO-pushed deployment; affiliate model persists post-Operation-Cronos. Template applies to ALPHV/BlackCat (Rust, ESXi), Akira, Black Basta.",
  "confidence": "probable"
}

Kill-chain emulation

CONOPS kill_chain (copy into conops.json)

1. recon — quick AD/host/share discovery (affiliates often buy access, so recon is light) (4).
2. initial-access — broker creds / edge exploit / RDP / phishing (1-2).
3. post-exploit — beacon, cred access, DA via DCSync, gated defense evasion + backup sabotage, lateral push (3-8).
4. c2 — Sliver (3).
5. exfiltration — bulk exfil then canary double-extortion encryption (9-10).

OPSEC & signature fidelity

• Fast and loud at the end. Affiliates exfil first (double extortion), then deploy domain-wide in one push — mirror that sequencing so backup/EDR/segmentation are exercised.
• GPO/PsExec mass deployment is the fidelity-defining move; the test is whether one Domain-Admin compromise really equals estate-wide encryption.
• Hit ESXi as well as Windows — RaaS crews target hypervisors for maximum impact.

RoE / safety gates

• Defense-evasion (Defender-disable via GPO), shadow-copy/backup deletion, mass deployment, and encryption are destructive — lab/canary only, with explicit authorization. Add an EMERGENCY abort: "production endpoint protection disabled, production backups/shadow copies deleted, real data exfiltrated, or a production host encrypted."
• Exfil destination is an engagement-controlled bucket seeded with canary data only.

Deconfliction

• Record broker/edge foothold, beacon, GPO changes (and their rollback), exfil destination, and the canary encryptor hash in deconfliction.json + cleanup.json.
• Agree the defense-evasion + deployment window with the SOC; the deliverable is the time-to-DA, backup-resilience, and exfil-detection findings — not a real outage.

Fidelity notes (deviations)

• No real LockBit/ALPHV locker. The impact step runs a canary encryptor against a lab/canary host set; StealBit is replaced by rclone to an engagement bucket.
• This playbook is the reusable RaaS template: to emulate ALPHV/BlackCat (Rust, ESXi-first), Akira, or Black Basta, change actor_name/actor_aliases, leave group_id empty (MITRE tracks these as software, not groups — see ../../references/apt-groups.md crosswalk), and adjust the initial-access row to the crew's preferred vector.