Digital Forensic Analysis of Lockbit Ransomware Attack on Operational Technology

In recent years, the prevalence and sophistication of ransomware attacks have highlighted a significant cybersecurity threat to Operational Technology (OT) and Industrial Control Systems (ICS) systems. These systems are important for energy, manufacturing, and transportation sectors. Among these threats, the LockBit ransomware has become the main adversary. It is known for its advanced strategies, techniques, and procedures (TTP). LockBit’s capabilities have infiltrated and attempted to disrupt critical functionality. This group of threats causes system outages and data security. This article analyzes LockBit attack methods, impacts, and strategies, supported by case studies and detailed analysis of the attack framework. This study aims to identify attack methods and procedures to recommend strategies to strengthen the prevention of such attacks further. With a large number of OT-targeted attacks from January to June 2024, there is an urgent need to improve security in the industrial sector.