The group emerged in 2019 and the LockBit named ransomware was first seen on a Russian-language based cybercrime forums in January 2020 and it listed its first victim to its leak site in September 2020. Because of its links with Russian-language forums, many security analysts believe the gang was based in, or at least heavily connected with, Russia.

Source: Infosecurity