LockBit ransomware exploits Windows Defender to deploy cobalt strike payload

A new report published by SentinelOne last week revealed that the threat actors (TA) associated with the LockBit 3.0 ransomware-as-a-service (RaaS) operation have been abusing the Windows Defender command-line tool to decrypt and load Cobalt Strike payloads.