Skip to content
844-974-8669 Ask Zeus Book a call

Intelligence briefFall/Winter 2026/2027 Edition

LockBit is back as LockBit 5.0 and ranked fourth on leak sites in early 2026

Taken down in February 2024, LockBit relaunched as LockBit 5.0 in September 2025 with Windows, Linux and ESXi encryptors and posted 163 victims in Q1 2026. Patch edge devices and protect hypervisors now.

Download the PDF, 799 KB Talk to the SOC

At a glance

RW-03 · Ransomware group

  • 163 victims posted by LockBit in Q1 2026, up from 79 in Q4 2025 (Check Point)[1]
  • 7,000+ attacks built with LockBit services, June 2022 to February 2024 (NCA)[11]
  • $500M+ ransom payments LockBit is alleged to have received, per US Treasury[10]
  • $10M maximum US reward for information leading to Khoroshev's arrest and/or conviction[10]
Status
Active as LockBit 5.0, announced on the RAMP forum in early September 2025[4]
Initial access
Vulnerability exploitation, brute-force attempts, phishing and leaked or stolen credentials (Halcyon, July 2026)[6]
Platforms hit
Windows, Linux and VMware ESXi variants[2]
Affiliate entry
About $500 in Bitcoin as a deposit for panel and encryptor access[3]
Leader
Dmitry Yuryevich Khoroshev (LockBitSupp), US indicted, sanctioned by the US, UK and Australia, US reward of up to $10 million[10]
Extortion
Leak threat backed by a personalized negotiation link with a 30-day deadline before stolen data is published[3]

What happened

LockBit was the most dominant ransomware-as-a-service operation until Operation Cronos, led by the UK National Crime Agency and the FBI, seized its infrastructure on February 19, 2024 and later unmasked its leader. The brand lost ground after the takedown, was itself hacked in May 2025, and then relaunched as LockBit 5.0 in September 2025. By the first quarter of 2026 it was again one of the most active leak-site posters.

  • Before the takedown LockBit accounted for 20 to 30 percent of all data-leak-site victim postings according to Check Point, and Treasury says it targeted more than 2,500 victims worldwide and is alleged to have received more than $500 million in ransom payments.
  • Operation Cronos took down 28 affiliate servers, froze more than 200 cryptocurrency accounts, obtained the platform's source code and led to arrests in Poland and Ukraine; later phases added four more arrests, sanctions on Evil Corp member Aleksandr Ryzhenkov as a LockBit affiliate, and in February 2025 Treasury sanctions on the Zservers bulletproof host.
  • On May 7, 2024 authorities named Dmitry Khoroshev as LockBitSupp: the US, UK and Australia sanctioned him, the US unsealed a 26-count indictment with a 185-year maximum sentence, and a reward of up to $10 million was announced.
  • On May 7, 2025 BleepingComputer reported that LockBit's affiliate panels had been defaced and a MySQL database leaked, exposing 59,975 Bitcoin addresses, 4,442 negotiation messages and 75 panel accounts with plaintext passwords.
  • LockBit 5.0 appeared in early September 2025 with Windows, Linux and ESXi variants, and Trend Micro found it shares hashing and API-resolution code with LockBit 4.0; Check Point counted 163 victims posted by LockBit in Q1 2026, up 106 percent from 79 in Q4 2025, placing it fourth worldwide.
  • DragonForce announced a supposed coalition with Qilin and LockBit in September 2025, and ReliaQuest expected it to share techniques and infrastructure, but Check Point calls the declarations largely symbolic and Halcyon says no combined leak site or joint attacks have been confirmed.

How it works

The attack as a living map, in kill-chain order from the first foothold to impact. Point at a step to light its wiring, click to pin its story.

at risk
  • entry
  • next step
  • impact

Read the attack chain

The threat on the left, each step in order, the people at risk on the right: point at a step to light its wiring, click to pin its story here.
00the attack chain
  • entry
  • next step
  • impact

Tap a node to read its story.

Step by step

  1. Get in through edge devices and logins

    MITRE ATT&CK T1190 (opens in a new tab)

    CISA lists exploitation of public-facing applications, external remote services, valid accounts and phishing as LockBit affiliate entry points. The late-2023 Citrix Bleed campaign is the best-documented example: LockBit 3.0 affiliates used it against Boeing's parts and distribution business, and a researcher reported an unpatched NetScaler at ICBC. An unpatched NetScaler let attackers bypass passwords and MFA by hijacking sessions.

  2. Turn off defenses and wipe tracks

    MITRE ATT&CK T1562.001 (opens in a new tab)

    The LockBit 5.0 Windows loader decrypts its payload in memory, patches the EtwEventWrite API to blind telemetry, terminates security services matched against a hardcoded list of 63 hashed names, and clears all Windows event logs after encryption.

  3. Steal data to back the ransom demand

    MITRE ATT&CK T1567.002 (opens in a new tab)

    Affiliates exfiltrate victim data with LockBit's StealBit tool and with Rclone and file-sharing services such as MEGA, so that a leak threat backs the ransom demand (CISA, 2023). Operation Cronos showed the group kept victim data even after payment.

  4. Encrypt Windows, Linux and ESXi

    MITRE ATT&CK T1486 (opens in a new tab)

    LockBit 5.0 has Windows, Linux and VMware ESXi variants; files get randomized 16-character extensions and the malware exits on Russian-language systems. In its first look at about a dozen victims in September 2025, Check Point observed roughly 80 percent of attacks on Windows and 20 percent on ESXi and Linux.

  5. Extort on a 30-day clock

    Ransom notes now name LockBit 5.0 and carry a personalized Tor negotiation link with a 30-day deadline before stolen data is published on the leak site.

Who is at risk

Any organization with an unpatched internet-facing appliance, exposed remote access or a VMware ESXi estate is in scope, and Halcyon says LockBit 5.0 affiliate rules explicitly permit attacks on critical infrastructure and medical facilities.

  • Business services lead LockBit 5.0 victim claims, followed by manufacturing, technology and healthcare, according to Halcyon.
  • The United States leads cumulative claims, but Check Point puts it at 21.2 percent of LockBit's Q1 2026 victims against more than 50 percent historically, with Italy and Brazil at 8.6 percent each and Turkey at 5.1 percent.
  • Organizations running VMware ESXi face an encryptor that Trend Micro says is designed to encrypt entire virtual machine infrastructures in a single attack.
  • Local governments and courts remain exposed: LockBit's attack on Fulton County, Georgia in early 2024 disrupted county phones, internet access and its court system, and officials said no ransom was paid.
  • Large firms and defense suppliers are proven targets: LockBit 3.0 affiliates used Citrix Bleed against Boeing's parts and distribution business, and Treasury links the November 2023 attack on ICBC's US broker-dealer to LockBit.

Sectors in scope

  • Business services
  • Manufacturing
  • Technology
  • Healthcare
  • Financial services
  • Aerospace and defense
  • State and local government
04What changed

What changed since the last edition

Fall/Winter 2026/2027 Edition8 changes

  1. LockBit relaunched as LockBit 5.0. The administrator announced it on the RAMP forum in early September 2025, on the operation's sixth anniversary, and asked new affiliates for a Bitcoin deposit of roughly $500. Check Point describes it as an upgraded evolution of LockBit 4.0 with Windows, Linux and ESXi variants.

    Source 4

  2. Leak-site activity rebounded. Check Point counted 163 victims posted by LockBit in Q1 2026 (85 in January, 33 in February, 45 in March), up 106 percent from 79 in Q4 2025, which lifted it from outside the top 10 to fourth place globally, just behind The Gentlemen with 166.

    Source 1

  3. Mid-2026 momentum is unsettled. Halcyon's profile, updated July 27, 2026, says activity declined through spring before a June 2026 resurgence on the 5.0 leak site, up more than 500 percent month over month and ongoing as of July; the same page also says activity peaked in Q1 and tapered afterward.

    Source 6

  4. DragonForce announced a supposed coalition with Qilin and LockBit on the RAMP forum in September 2025. Check Point calls these declarations largely symbolic, with no verified evidence of shared infrastructure or joint operations.

    Source 4

  5. LockBit was hacked. On May 7, 2025 its affiliate panels were defaced with the message 'Don't do crime CRIME IS BAD xoxo from Prague' and a MySQL dump leaked 59,975 Bitcoin addresses, affiliate builds, 4,442 negotiation messages dated December 19 to April 29, and 75 user accounts with plaintext passwords; LockBitSupp confirmed the breach but said no private keys were leaked or data lost.

    Source 8

  6. Prosecutions advanced. Rostislav Panev, a 51-year-old dual Russian and Israeli national accused of helping develop LockBit, was arrested in Israel in August 2024 and extradited to the United States, as the Justice Department announced in March 2025; SecurityWeek reported at that time that Khoroshev and others remained at large, with rewards of up to $10 million.

    Source 9

  7. Sanctions advanced. Treasury sanctioned the Russia-based bulletproof host Zservers and two administrators on February 11, 2025 for leasing IP addresses to LockBit affiliates, and said in the same release that LockBit was responsible for the November 2023 attack on ICBC's US broker-dealer.

    Source 16

  8. The 'operating at 73 percent reduced capacity with 69 affiliates' framing is out of date. Those were NCA figures from May 2024: average monthly LockBit attacks in the UK down 73 percent and active affiliates down to 69 since the February 2024 action. Check Point ranked LockBit fourth worldwide in Q1 2026, although far below the 20 to 30 percent of postings it held before Cronos.

    Source 11

What to do now

In priority order, highest impact first.

  1. Do firstPatch or isolate internet-facing appliances (NetScaler, VPN gateways, firewalls, remote management tools) within 24 to 48 hours of a CISA Known Exploited Vulnerabilities listing.

    LockBit 3.0 affiliates used Citrix Bleed to bypass passwords and MFA on unpatched NetScaler appliances, including at Boeing Distribution, and CISA lists exploitation of public-facing applications as a LockBit entry point.

  2. Enforce phishing-resistant MFA on VPN, remote desktop, email and every administrative account, and restrict RDP to a jump host.

    Valid accounts, phishing and external remote services are documented LockBit entry points; phishing-resistant MFA blunts credential theft, while session-hijacking flaws such as Citrix Bleed also require fast patching.

  3. Keep offline, immutable backups that include hypervisor-level copies of virtual machines, and test a full restore each quarter.

    LockBit 5.0 ships an ESXi encryptor, so a backup that lives on the same virtual estate is not a backup.

  4. Lock down VMware ESXi and other hypervisor management interfaces: no internet exposure, separate admin credentials, and alerts on unexpected VM shutdowns or file renames.

    Check Point's early sample put about one in five LockBit 5.0 attacks on ESXi or Linux, and Trend Micro says the ESXi encryptor is built to encrypt entire virtual machine infrastructures in one attack.

  5. Run EDR with tamper protection on every server and endpoint, and alert on mass service termination, ETW patching and event log clearing.

    Trend Micro documents ETW patching and security-service termination in the loader and event log clearing after encryption, so these behaviors can give early warning.

  6. Decide your ransom policy before an incident, with counsel and an OFAC sanctions check, and assume stolen data will be published whether or not you pay.

    LockBit's leader is a sanctioned person, and Operation Cronos showed the group kept victim data it had promised to delete.

  7. Segment networks and monitor for lateral movement over RDP and SMB, mass file access and large outbound transfers to cloud storage.

    LockBit affiliates exfiltrate data with tools such as StealBit, Rclone and MEGA, activity a 24/7 SOC can detect; Z7 Solutions™ provides that monitoring for mid-size organizations, school districts and public agencies.

Indicators

Indicators the sources publish, shown as they print them. Use them to hunt and to enrich alerts, and check the source before you block.

Indicators published by the sources
TypeIndicatorSource
behavior Encrypted files renamed with randomized 16-character extensions; no traditional infection marker at end of file [2]
behavior EtwEventWrite API patched with a return instruction, then security services terminated against a hardcoded list of 63 hashed service names [2]
behavior All Windows event logs cleared via EvtClearLog after encryption completes [2]
behavior Process exits when Russian language settings or Russian geolocation are detected [2]
behavior Ransom note names LockBit 5.0 and includes a personalized Tor negotiation link with a 30-day publication deadline [3]

Sources

Every number and claim in this brief traces to a source below. Each source opens in a new tab at the publisher.

  1. [1]
    The State of Ransomware, Q1 2026 (opens in a new tab) Check Point Research · May 11, 2026 · research.checkpoint.com
  2. [2]
    New LockBit 5.0 Targets Windows, Linux, ESXi (opens in a new tab) Trend Micro (Trend Research) · September 25, 2025 · trendaisecurity.com
  3. [3]
    LockBit Returns, and It Already Has Victims (opens in a new tab) Check Point Research · October 23, 2025 · blog.checkpoint.com
  4. [4]
    The State of Ransomware, Q3 2025 (opens in a new tab) Check Point Research · November 13, 2025 · research.checkpoint.com
  5. [5]
  6. [6]
    Threat group profile: LockBit (5.0) (opens in a new tab) Halcyon · updated July 27, 2026 · halcyon.ai
  7. [8]
    LockBit ransomware gang hacked, victim negotiations exposed (opens in a new tab) BleepingComputer · May 7, 2025 · bleepingcomputer.com
  8. [9]
  9. [10]
    Treasury sanctions LockBit leader Dmitry Yuryevich Khoroshev (press release jy2326) (opens in a new tab) U.S. Department of the Treasury · May 7, 2024 · home.treasury.gov
  10. [11]
    LockBit leader unmasked and sanctioned (opens in a new tab) UK National Crime Agency · May 7, 2024 · nationalcrimeagency.gov.uk
  11. [12]
  12. [13]
    International investigation disrupts the world's most harmful cyber crime group (opens in a new tab) UK National Crime Agency · February 20, 2024 · nationalcrimeagency.gov.uk
  13. [14]
  14. [15]
    Treasury sanctions Evil Corp members including Aleksandr Ryzhenkov (press release jy2623) (opens in a new tab) U.S. Department of the Treasury · October 1, 2024 · home.treasury.gov
  15. [16]
  16. [17]
    Russian Court Indicts Alleged Ransomware Hacker Wanted by the FBI (opens in a new tab) BankInfoSecurity · December 2, 2024 · bankinfosecurity.com
  17. [18]
  18. [19]
    Understanding Ransomware Threat Actors: LockBit (AA23-165A) (opens in a new tab) CISA, FBI, MS-ISAC and international partners · June 14, 2023 · cisa.gov
  19. [20]
    LockBit ransomware leaks gigabytes of Boeing data (opens in a new tab) BleepingComputer · November 12, 2023 · bleepingcomputer.com
  20. [21]
    Royal Mail cyberattack linked to LockBit ransomware operation (opens in a new tab) BleepingComputer · January 12, 2023 · bleepingcomputer.com
  21. [22]
    Fulton County, Security Experts Call LockBit's Bluff (opens in a new tab) Krebs on Security · February 29, 2024 · krebsonsecurity.com
  22. [23]
  23. [25]
  24. [26]
    Dark Web Profile: LockBit 3.0 Ransomware (opens in a new tab) SOCRadar · updated September 30, 2026 · socradar.io
  25. [27]
  26. [28]
    The State of Ransomware, Q2 2026 (opens in a new tab) Check Point Research · August 13, 2026 · research.checkpoint.com
  27. [29]
    Chinese multinational bank hit by ransomware (opens in a new tab) Help Net Security · November 10, 2023 · helpnetsecurity.com

Z7 Weekly Intelligence

We aim for one email a week: the threats that matter, new Z7 intelligence briefs and articles, and what to do about them. Unsubscribe anytime.

By subscribing, you agree to our Terms of Use. Our Privacy Policy explains how we use your email.

All Z7 Cyber Intelligence briefs
  • RW-02Ransomware group active

    Part 2 of 2

    Qilin still hits hospitals and infrastructure

    TakeawayPatch edge gateways, enforce MFA and vet IT provider access.

    • 2,367 victims listed on Qilin's leak site since October 2022
    • 1 patient death linked to the Synnovis outage
    • Qilin
    • Ransomware group
    • Healthcare and diagnostic suppliers
    PDF822 KB
  • RW-04Ransomware group active

    Akira still exploits SonicWall VPNs in 2026

    TakeawayPatch, reset VPN credentials, require MFA and watch failed logins.

    • $244.17M ransomware proceeds Akira had claimed as of late September 2025
    • 750 Akira leak-site claims in 2025 (ransomware.live)
    • Akira
    • Ransomware group
    • Manufacturing
    PDF827 KB
  • RW-01Ransomware group active

    Part 1 of 2

    Qilin still tops most ransomware counts

    TakeawayPatch VPN gateways and require MFA first.

    • 165 Qilin incidents ZeroFox counted in August 2026
    • 17 months consecutive months as the most active group (ZeroFox)
    • Qilin
    • Ransomware group
    • Manufacturing
    PDF860 KB

What does this mean for your security?

Bring your questions about exposure, defenses and cost. Talk with our team about what applies to your environment and where to start.

Book a security conversationAsk Zeus Call 844-974-8669
Ask Zeus AI assistant