S1200: StealBit

StealBit is a data exfiltration tool that is developed and maintained by the operators of the the LockBit Ransomware-as-a-Service (RaaS) and offered to affiliates to exfiltrate data from compromised systems for double extortion purposes.[1][2]

EnterpriseS1200MalwareObject v1.0ModifiedJan 29, 2025, 20:17 UTC (UTC+00:00)

S1200: StealBit describes [StealBit](https://attack.mitre.org/software/S1200) is a data exfiltration tool that is developed and maintained by the operators of the the LockBit Ransomware-as-a-Service (RaaS) and offered to affiliates to exfiltrate data from compromised systems for double extortion purposes.(Citation: Cybereason StealBit Exfiltration Tool)(Citation: FBI Lockbit 2.0 FEB 2022)

Executive priority

S1200: StealBit is an official MITRE ATT&CK software. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.

Technical view

Security teams should validate S1200: StealBit by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (Windows), and available local telemetry before making detection or mitigation decisions.

Likely telemetry

Official ATT&CK relationships and object metadata
Network, endpoint, and security-tool telemetry

Detection direction

Validate whether S1200: StealBit appears in your detection coverage and tabletop scenarios.
Use the object to align executive risk language with SOC, incident response, and detection engineering work.
Do not treat ATT&CK relationship context as attribution without corroborating evidence.

Mitigation priorities

Map the object to existing controls and identify missing telemetry or response ownership.
Prioritize mitigations that reduce exposure on the listed platforms and tactics.
Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.

Additional notes and limits

Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.

This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

StealBit

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

Filter related techniques15 rows

Domain	ID	Name	Relationship / procedure
Enterprise	T1622	Debugger Evasion	StealBit can detect it is being run in the context of a debugger.[1]
Enterprise	T1559	Inter-Process Communication	StealBit can use interprocess communication (IPC) to enable the designation of multiple files for exfiltration in a scalable manner.[1]
Enterprise	T1070.004	File DeletionSub-technique	StealBit can self-delete its executable file from the compromised system.[1][2]
Enterprise	T1030	Data Transfer Size Limits	StealBit can be configured to exfiltrate files at a specified rate to evade network detection mechanisms.[1]
Enterprise	T1027.013	Encrypted/Encoded FileSub-technique	StealBit stores obfuscated DLL file names in its executable.[1]
Enterprise	T1106	Native API	StealBit can use native APIs including `LoadLibraryExA` for execution and `NtSetInformationProcess` for defense evasion purposes.[1]
Enterprise	T1082	System Information Discovery	StealBit can enumerate the computer name and domain membership of the compromised system.[1]
Enterprise	T1480	Execution Guardrails	StealBit will execute an empty infinite loop if it detects it is being run in the context of a debugger.[1]
Enterprise	T1005	Data from Local System	StealBit can upload data and files to the LockBit victim-shaming site.[2][1]
Enterprise	T1614.001	System Language DiscoverySub-technique	StealBit can determine system location based on the default language setting and will not execute on systems located in former Soviet countries.[1]
Enterprise	T1095	Non-Application Layer Protocol	StealBit can use the Windows Socket networking library to communicate with attacker-controlled endpoints.[1]
Enterprise	T1685	Disable or Modify Tools	StealBit can configure processes to not display certain Windows error messages by through use of the `NtSetInformationProcess`.[1]
Enterprise	T1071.001	Web ProtocolsSub-technique	StealBit can use HTTP to exfiltrate files to actor-controlled infrastructure.[2][1]
Enterprise	T1140	Deobfuscate/Decode Files or Information	StealBit can deobfuscate loaded modules prior to execution.[2][1]
Enterprise	T1083	File and Directory Discovery	StealBit can be configured to exfiltrate specific file types.[2][1]

Relationship explorer

All related ATT&CK context

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release: 19.2
Object version: 1.0
Created: Jan 29, 2025, 20:13 UTC (UTC+00:00)
Modified: Jan 29, 2025, 20:17 UTC (UTC+00:00)
Raw hash: b55a6e61c73e9db3...

Imported snapshots across ATT&CK releases(2)

Release	Bundle imported	Object version	Modified	Status	Raw hash
19.2	Aug 6, 2026, 02:58 UTC (UTC+00:00)	1.0	Jan 29, 2025, 20:17 UTC (UTC+00:00)	Current bundle	`b55a6e61c73e…`
19.1	Jul 14, 2026, 09:14 UTC (UTC+00:00)	1.0	Jan 29, 2025, 20:17 UTC (UTC+00:00)	Older bundle	`b55a6e61c73e…`

Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy

Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

[1]
Cybereason StealBit Exfiltration Tool
Cybereason Global SOC Team. (n.d.). THREAT ANALYSIS REPORT: Inside the LockBit Arsenal - The StealBit Exfiltration Tool. Retrieved January 29, 2025.
Open source URL
[2]
FBI Lockbit 2.0 FEB 2022
FBI. (2022, February 4). Indicators of Compromise Associated with LockBit 2.0 Ransomware. Retrieved January 24, 2025.
Open source URL
[3]
mitre-attackS1200
Open source URL

Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use