ransomware-group-operationransomware-tooling-evolutioncybercrime-service-ecosystemdetection-content-update

LockBit 5.0 Ransomware Variants and Updated Affiliate Panel Exposed

Threat Actor Intelligence · 2 sources · Updated 4mo ago · First seen Jan 23, 2026

Security researchers reported that LockBit has continued operating after the law-enforcement disruption known as Operation Cronos, releasing multiple new LockBit 5.0 payload variants and maintaining an active ransomware-as-a-service (RaaS) affiliate ecosystem. Reporting citing Flare.io analysis described four newly observed builds labeled LB_Black_14_01_2026 (Windows), LB_Linux_14_01_2026 (Linux), LB_ESXi_14_01_2026 (VMware ESXi), and LB_ChuongDong_14_01_2026 (specialized deployments), indicating an ongoing multi-platform targeting strategy.

Analysis of the latest LockBit 5.0 affiliate panel indicated the operation’s core workflows remain largely intact, with only minor cosmetic/interface changes (including holiday-themed elements). The panel reportedly supports coordination of multiple concurrent campaigns and includes capabilities for attack management, affiliate onboarding, and victim payment/negotiation handling—signaling continued operational maturity despite reputational damage and prior takedown pressure. Researchers recommended organizations prioritize updated detection/signatures and closely monitor EDR alerts for activity consistent with these new LockBit 5.0 variants.

Know this adversaryTTPs, infrastructure, and targeting history in one profile.

Get the profile

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

4 events · Jan 21, 2026

Jan 21, 202610mo ago
Researchers report LockBit affiliate program is still recruiting
Analysis of the affiliate panel indicated that LockBit continued onboarding and recruiting affiliates even after reputational damage and prior law-enforcement disruption. The panel was described as supporting multiple concurrent campaigns and attack coordination.
Jan 21, 202610mo ago
Researchers uncover LockBit 5.0 affiliate panel details
Researchers obtained leaked materials and screenshots exposing LockBit's affiliate panel, including campaign management, negotiations, payments, partner rules, and recruitment processes. The analysis found the group largely preserved its established operating model, with only minor cosmetic interface changes.
Jan 21, 202610mo ago
LockBit releases new 5.0 ransomware variants
LockBit released new LockBit 5.0 payload variants targeting Windows, Linux, and VMware ESXi environments, showing continued focus on enterprise and virtualized systems. Reporting indicates at least four variants were identified by researchers.
Jan 21, 202610mo ago
Operation Cronos partially disrupts LockBit infrastructure
Law-enforcement action under Operation Cronos partially shut down LockBit infrastructure, but did not fully stop the ransomware-as-a-service operation. Later reporting describes subsequent LockBit activity as continuing despite this disruption.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Threat actors

1 linked

LockBit

Malware

1 linked

LockBit

Do you run this?See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.

Get the Full Actor Profile

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

ScworldNews · Jan 23, 2026

New LockBit 5.0 variants, affiliate panel uncovered | SC MediaOpen source ↗

Cyber Security NewsNews · Jan 21, 2026

Researchers Uncovered LockBit’s 5.0 Latest Affiliate Panel and Encryption VariantsOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

LockBit 5.0 Ransomware Variants and Updated Affiliate Panel Exposed

How this story unfolded

Researchers report LockBit affiliate program is still recruiting

Researchers uncover LockBit 5.0 affiliate panel details

LockBit releases new 5.0 ransomware variants

Operation Cronos partially disrupts LockBit infrastructure

Related entities

Threat actors

Malware

Sources

See the full picture, correlated to your attack surface.

Related stories

LockBit 5.0 Revives Cross-Platform Ransomware Operations

LockBit 5.0 Ransomware Introduces Advanced Encryption and Maintains Global Dominance

LockBit 5.0 Infrastructure Exposure and Post-Takedown Activity

LockBit 5.0 Ransomware Variants and Updated Affiliate Panel Exposed

How this story unfolded

Researchers report LockBit affiliate program is still recruiting

Researchers uncover LockBit 5.0 affiliate panel details

LockBit releases new 5.0 ransomware variants

Operation Cronos partially disrupts LockBit infrastructure

Related entities

Threat actors

Malware

Sources

See the full picture, correlated to your attack surface.

Related stories

LockBit 5.0 Revives Cross-Platform Ransomware Operations

LockBit 5.0 Ransomware Introduces Advanced Encryption and Maintains Global Dominance

LockBit 5.0 Infrastructure Exposure and Post-Takedown Activity