StealBit

aliases

Last seen:Mar 17, 2026

Intelligence Profile

This is a stealer used by LockBit 2.0.

Threat Analysis

StealBit is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://securelist.com/new-ransomware-trends-in-2022/106457/

→https://twitter.com/r3c0nst/status/1425875923606310913

→https://www.accenture.com/us-en/blogs/security/stealbit-exmatter-exfiltration-tool-analysis

→https://www.cybereason.com/blog/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool

→https://yoroi.company/research/hunting-the-lockbit-gangs-exfiltration-infrastructures/

Quick Facts

TypeAPT / Threat Group

Aliases3

Also Known As

win.stealbitStealBitCorrempa

External Intelligence

Malpedia: win.stealbit

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search StealBit