Loading story…
Researchers report that LockBit has resumed operations with a new LockBit 5.0 strain that targets Windows, Linux, and VMware ESXi systems, extending the group’s established cross-platform ransomware model after the disruption caused by Operation Cronos. Analysis of a newly discovered sample found strong code continuity with LockBit 4.0, indicating the malware is an evolution of the original codebase rather than a copycat. The new version adds heavy obfuscation, anti-analysis, and anti-forensics capabilities, including in-memory payload loading through DLL reflection, ETW patching, security service termination, and event log clearing, while the ESXi variant is built to encrypt virtualized environments at scale.
Separate reporting ties LockBit activity to real-world intrusions and common access vectors. SecurityScorecard assessed a claimed attack on a major state-owned Southeast Asian bank and found network and malware evidence consistent with credential theft, SSH/RDP-based access, and possible data exfiltration before and after the victim appeared on LockBit’s leak site, though some public claims could not be independently verified. Another SecurityScorecard investigation found attackers exploiting PaperCut flaws CVE-2023-27350 and CVE-2023-27351, with CVE-2023-27350 used to deliver LockBit in observed cases, underscoring how the group and its affiliates continue to pair opportunistic vulnerability exploitation with mature, multi-platform ransomware tooling.
TTPs, infrastructure, and targeting history in one profile.
8 events from the most recent confirmed update back to the earliest known activity.
LockBit publicly claimed an attack against a major state-owned bank in Southeast Asia on May 8. SecurityScorecard later analyzed network and malware evidence consistent with multiple stages of a ransomware intrusion.
A reverse-engineering writeup focused on LockBit ransomware v4.0 was published on March 15, 2025.
Operation Cronos disrupted LockBit group infrastructure in February 2024, according to Trend Research.
Security researchers announced the discovery of CVE-2023-27350 and CVE-2023-27351 on April 26, 2023. CVE-2023-27350 was identified as the more severe flaw, enabling remote code execution.
A PaperCut customer detected suspicious behavior on a PaperCut server on April 18, 2023, bringing the vulnerabilities to the company’s attention.
PaperCut concluded that the earliest activity suggesting possible exploitation of CVE-2023-27350 and CVE-2023-27351 appeared on April 14, 2023.
Trend Research identified and analyzed a new LockBit 5.0 ransomware binary found in the wild and confirmed Windows, Linux, and ESXi variants. The researchers concluded it is an evolution of the original LockBit codebase rather than an imitation or rebrand.
Trend Research reported that the LockBit group resurfaced in early September and announced the release of LockBit 5.0 for its sixth anniversary.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 65 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
trendaisecurity.com
Open sourcesecurityscorecard.com
Open sourcesecurityscorecard.com
Open sourcechuongdong.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Acronis Threat Research Unit reported active campaigns using **LockBit 5.0**, a major update to the **LockBit** ransomware-as-a-service (RaaS) operation that broadens targeting across **Windows, Linux, and VMware ESXi** in coordinated intrusions. The variant continues **double extortion** (data theft plus encryption) and is positioned for enterprise impact by enabling attackers to hit endpoints, servers, and hypervisors—where a single ESXi compromise can disrupt many virtual machines at once. Reporting also notes the group’s claimed ability to operate against **Proxmox** virtualization environments, further expanding the potential attack surface in organizations adopting alternative hypervisors. Technical analysis highlights stronger and more enterprise-focused builds, with the **Windows** payload using advanced defense-evasion and anti-analysis techniques such as packing/obfuscation, **DLL unhooking**, **process hollowing**, and **ETW (Event Tracing for Windows) patching**, alongside log-clearing to reduce forensic visibility. The **Linux/ESXi** builds are described as less reliant on packing but use extensive string encryption to hinder detection, while maintaining strong encryption routines and using randomized file extensions; Acronis-linked reporting also cites faster encryption and continuity with LockBit 4’s design. Victimology cited in coverage indicates a heavy focus on the **U.S. business sector** and a broad spread across industries (including manufacturing, healthcare, education, financial services, and government), with dozens of recent leak-site postings used to pressure victims and demonstrate ongoing operational tempo despite law-enforcement disruption efforts.
Jun 29, 2026
LockBit 5.0 ransomware has emerged as a significant evolution in the ransomware landscape, introducing advanced cross-platform capabilities that enable it to target Windows, Linux, and VMware ESXi environments simultaneously. Security researchers from Trend Micro have analyzed the new variant and warn that it is considerably more dangerous than previous versions due to its technical enhancements and expanded reach. The Windows variant of LockBit 5.0 now utilizes DLL reflection for payload loading and incorporates aggressive anti-analysis packing, making detection and analysis more challenging for defenders. The Linux version is engineered to accept command-line directives, allowing attackers to specify which directories and file types to encrypt, thereby increasing the precision and impact of attacks. For ESXi environments, the ransomware is capable of encrypting virtual machines directly, threatening the core of enterprise virtualization infrastructure. Each encrypted file is marked with a random 16-character extension, a tactic designed to complicate data recovery and frustrate incident response efforts. The modular architecture of LockBit 5.0, combined with stealthy encryption routines, enables attackers to paralyze entire enterprise stacks, from endpoints to critical servers and hypervisor hosts. This cross-platform strategy reflects LockBit’s ongoing efforts to maximize disruption and ransom leverage by hitting organizations at multiple layers of their IT infrastructure. The release of LockBit 5.0 follows a major law enforcement operation earlier in the year, known as Operation Cronos, in which UK and US authorities seized LockBit’s servers, domain infrastructure, and decryption keys. Despite these efforts to dismantle the group, LockBit has demonstrated resilience by reactivating its affiliate network and launching this new, more sophisticated variant. The technical improvements in obfuscation and evasion techniques make LockBit 5.0 particularly challenging for security teams to detect and mitigate. The ransomware’s ability to operate across different operating systems means that organizations must ensure comprehensive security coverage, including endpoints, servers, and virtualization platforms. The evolution of LockBit into a cross-platform threat underscores the increasing complexity of the ransomware ecosystem and the need for robust, multi-layered defense strategies. Security experts recommend that organizations review and strengthen their backup, segmentation, and incident response plans in light of LockBit 5.0’s capabilities. The rapid adaptation and technical sophistication of LockBit 5.0 highlight the ongoing arms race between ransomware operators and defenders. As LockBit continues to evolve, it is expected that other ransomware groups may follow suit, further raising the stakes for enterprise cybersecurity. The emergence of LockBit 5.0 serves as a stark reminder of the persistent and adaptive nature of ransomware threats facing organizations worldwide.
Jun 29, 2026
SecurityScorecard reported network and malware evidence consistent with a **LockBit** ransomware intrusion at a major state-owned bank in Southeast Asia after the group listed the organization on its leak site. Researchers observed indicators of possible credential theft, remote access over **SSH** and **RDP**, and large outbound data transfers before and after the public extortion claim, suggesting potential data exfiltration as part of the operation. The activity was linked to several IP addresses tied to malicious infrastructure, anonymizing VPN or proxy services, and a Russian IP address that may have accessed intermediary systems. The reported intrusion aligns with known **LockBit 3.0** capabilities documented by VMware, which described a highly configurable ransomware strain able to generate new variants from a leaked builder and target local systems, network shares, connected drives, and domain controllers. VMware said the malware uses anti-analysis techniques, privilege escalation, service termination, shadow-copy deletion, ransom-note deployment, and **Salsa20** file encryption, while communicating with command-and-control infrastructure over **TLS 1.2** using HTTP POST requests. The leaked builder and flexible configuration likely lowered the barrier for affiliates and helped sustain LockBit’s broad operational reach against enterprise victims.
Aug 21, 2026