LockBit 5.0 Ransomware Expands Cross-Platform Attacks on Windows, Linux, and VMware ESXi

Acronis Threat Research Unit reported active campaigns using LockBit 5.0, a major update to the LockBit ransomware-as-a-service (RaaS) operation that broadens targeting across Windows, Linux, and VMware ESXi in coordinated intrusions. The variant continues double extortion (data theft plus encryption) and is positioned for enterprise impact by enabling attackers to hit endpoints, servers, and hypervisors—where a single ESXi compromise can disrupt many virtual machines at once. Reporting also notes the group’s claimed ability to operate against Proxmox virtualization environments, further expanding the potential attack surface in organizations adopting alternative hypervisors.

Technical analysis highlights stronger and more enterprise-focused builds, with the Windows payload using advanced defense-evasion and anti-analysis techniques such as packing/obfuscation, DLL unhooking, process hollowing, and ETW (Event Tracing for Windows) patching, alongside log-clearing to reduce forensic visibility. The Linux/ESXi builds are described as less reliant on packing but use extensive string encryption to hinder detection, while maintaining strong encryption routines and using randomized file extensions; Acronis-linked reporting also cites faster encryption and continuity with LockBit 4’s design. Victimology cited in coverage indicates a heavy focus on the U.S. business sector and a broad spread across industries (including manufacturing, healthcare, education, financial services, and government), with dozens of recent leak-site postings used to pressure victims and demonstrate ongoing operational tempo despite law-enforcement disruption efforts.