LockBit 3.0 (aka LockBit Black) ransomware IOCs from CISA advisory AA23-165A and recent campaigns. LockBit operates as RaaS (Ransomware-as-a-Service) and remains one of the most prolific ransomware operations globally. TTPs: Initial access via RDP/VPN exploitation, Cobalt Strike for lateral movement, data exfiltration before encryption. Source: CISA AA23-165A, FBI Flash Reports