LockBit ransomware seeks initial access to target networks primarily through purchased access, unpatched vulnerabilities, insider access, and zero-day exploits. “Second-stage” LockBit establishes control of a victim's system, collects network information, and achieves primary goals such as stealing and encrypting data.