Loading story…
LockBit 5.0 ransomware has emerged as a significant evolution in the ransomware landscape, introducing advanced cross-platform capabilities that enable it to target Windows, Linux, and VMware ESXi environments simultaneously. Security researchers from Trend Micro have analyzed the new variant and warn that it is considerably more dangerous than previous versions due to its technical enhancements and expanded reach. The Windows variant of LockBit 5.0 now utilizes DLL reflection for payload loading and incorporates aggressive anti-analysis packing, making detection and analysis more challenging for defenders. The Linux version is engineered to accept command-line directives, allowing attackers to specify which directories and file types to encrypt, thereby increasing the precision and impact of attacks. For ESXi environments, the ransomware is capable of encrypting virtual machines directly, threatening the core of enterprise virtualization infrastructure. Each encrypted file is marked with a random 16-character extension, a tactic designed to complicate data recovery and frustrate incident response efforts. The modular architecture of LockBit 5.0, combined with stealthy encryption routines, enables attackers to paralyze entire enterprise stacks, from endpoints to critical servers and hypervisor hosts. This cross-platform strategy reflects LockBit’s ongoing efforts to maximize disruption and ransom leverage by hitting organizations at multiple layers of their IT infrastructure. The release of LockBit 5.0 follows a major law enforcement operation earlier in the year, known as Operation Cronos, in which UK and US authorities seized LockBit’s servers, domain infrastructure, and decryption keys. Despite these efforts to dismantle the group, LockBit has demonstrated resilience by reactivating its affiliate network and launching this new, more sophisticated variant. The technical improvements in obfuscation and evasion techniques make LockBit 5.0 particularly challenging for security teams to detect and mitigate. The ransomware’s ability to operate across different operating systems means that organizations must ensure comprehensive security coverage, including endpoints, servers, and virtualization platforms. The evolution of LockBit into a cross-platform threat underscores the increasing complexity of the ransomware ecosystem and the need for robust, multi-layered defense strategies. Security experts recommend that organizations review and strengthen their backup, segmentation, and incident response plans in light of LockBit 5.0’s capabilities. The rapid adaptation and technical sophistication of LockBit 5.0 highlight the ongoing arms race between ransomware operators and defenders. As LockBit continues to evolve, it is expected that other ransomware groups may follow suit, further raising the stakes for enterprise cybersecurity. The emergence of LockBit 5.0 serves as a stark reminder of the persistent and adaptive nature of ransomware threats facing organizations worldwide.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Security researchers reported a new LockBit ransomware variant, referred to as LockBit 5.0, that targets Windows, Linux, and VMware ESXi systems. The analysis described it as a major evolution of the malware and one of the most dangerous LockBit versions observed to date.
A new reference reported that LockBit ransomware had begun targeting Apple macOS systems, marking another expansion of the group's tooling beyond Windows and earlier Linux/ESXi-focused variants. This represented a new cross-platform development in LockBit's evolution.
Trend Micro published analysis of LockBit ransomware’s first variant targeting Linux and VMware ESXi environments. The report marked an early expansion of LockBit beyond Windows into virtualized and Linux-based infrastructure.
9 references tracked. Mallory keeps watching after this page renders.
levelblue.com
Open sourcelevelblue.com
Open sourcelevelblue.com
Open sourcelevelblue.com
Open sourcescworld.com
Open sourcesecurityonline.info
Open sourcego.theregister.com
Open sourcethehackernews.com
Open sourcetrendmicro.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Acronis Threat Research Unit reported active campaigns using **LockBit 5.0**, a major update to the **LockBit** ransomware-as-a-service (RaaS) operation that broadens targeting across **Windows, Linux, and VMware ESXi** in coordinated intrusions. The variant continues **double extortion** (data theft plus encryption) and is positioned for enterprise impact by enabling attackers to hit endpoints, servers, and hypervisors—where a single ESXi compromise can disrupt many virtual machines at once. Reporting also notes the group’s claimed ability to operate against **Proxmox** virtualization environments, further expanding the potential attack surface in organizations adopting alternative hypervisors. Technical analysis highlights stronger and more enterprise-focused builds, with the **Windows** payload using advanced defense-evasion and anti-analysis techniques such as packing/obfuscation, **DLL unhooking**, **process hollowing**, and **ETW (Event Tracing for Windows) patching**, alongside log-clearing to reduce forensic visibility. The **Linux/ESXi** builds are described as less reliant on packing but use extensive string encryption to hinder detection, while maintaining strong encryption routines and using randomized file extensions; Acronis-linked reporting also cites faster encryption and continuity with LockBit 4’s design. Victimology cited in coverage indicates a heavy focus on the **U.S. business sector** and a broad spread across industries (including manufacturing, healthcare, education, financial services, and government), with dozens of recent leak-site postings used to pressure victims and demonstrate ongoing operational tempo despite law-enforcement disruption efforts.
Jun 29, 2026
LockBit 5.0 has emerged as the latest evolution of the notorious ransomware-as-a-service operation, introducing sophisticated encryption algorithms and advanced anti-analysis techniques that significantly complicate detection and recovery efforts for targeted organizations. The malware now employs a combination of ChaCha20-Poly1305 for file encryption and X25519 with BLAKE2b for secure key exchange, while also terminating Volume Shadow Copy Service processes to prevent system recovery. LockBit 5.0’s runtime flexibility allows it to operate even without specific parameters, and its use of advanced packing and obfuscation further hinders static analysis by security professionals. Despite increased law enforcement pressure, LockBit has sustained its position as a dominant global ransomware threat, accounting for a substantial share of attacks worldwide. The group’s operations have impacted a wide range of sectors, including IT, electronics, law firms, and religious institutions, resulting in billions of dollars in ransom payments and recovery costs. LockBit continues to leverage its dark web platform to publicly list compromised organizations and stolen data, using these tactics to pressure victims into paying ransoms.
Jun 29, 2026
Security researchers reported that **LockBit** has continued operating after the law-enforcement disruption known as **Operation Cronos**, releasing multiple new **LockBit 5.0** payload variants and maintaining an active ransomware-as-a-service (RaaS) affiliate ecosystem. Reporting citing *Flare.io* analysis described four newly observed builds labeled `LB_Black_14_01_2026` (Windows), `LB_Linux_14_01_2026` (Linux), `LB_ESXi_14_01_2026` (VMware ESXi), and `LB_ChuongDong_14_01_2026` (specialized deployments), indicating an ongoing multi-platform targeting strategy. Analysis of the latest **LockBit 5.0 affiliate panel** indicated the operation’s core workflows remain largely intact, with only minor cosmetic/interface changes (including **holiday-themed** elements). The panel reportedly supports coordination of multiple concurrent campaigns and includes capabilities for attack management, affiliate onboarding, and victim payment/negotiation handling—signaling continued operational maturity despite reputational damage and prior takedown pressure. Researchers recommended organizations prioritize updated detection/signatures and closely monitor EDR alerts for activity consistent with these new LockBit 5.0 variants.
Jun 29, 2026