LockBit’s similarities to BlackMatter come from overlaps in the privilege escalation and harvesting routines used to identify APIs for process termination as well as the use of anti-debugging and threading techniques designed to thwart analysis.