LockBit 5.0 Cross-Platform Ransomware Analysis
LockBit 5.0 Cross-Platform Ransomware Analysis (TL-2026-0062) is a critical-severity ransomware operation, first published 2026-02-12. It is attributed to LockBit (Russia) with high confidence, references 2 CVEs (CVE-2024-55591, CVE-2024-47575), maps to 41 MITRE ATT&CK techniques (T1003, T1005, T1007), and is covered by 12 detection rules and 35 indicators of compromise.
Key facts for TL-2026-0062
- Threat ID
- TL-2026-0062
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- 2026-02-12
- Last reviewed
- 2026-02-12
- Attribution
- LockBit
- Attribution confidence
- HIGH
- Nation-state nexus
- Russia
- Motivation
- FINANCIAL
- Target sectors
- All Sectors, Healthcare, Government, Financial Services, Manufacturing, Technology, Education, Critical Infrastructure
- Target regions
- Global (excludes Russia and CIS)
- Detection rules
- 12
- Indicators of compromise
- 35
Malware and tooling in LockBit 5.0 Cross-Platform Ransomware Analysis
Malware and tooling: LockBit, Cobalt Strike, SystemBC
LockBit 5.0 represents the post-Operation Cronos resurgence of the world's most prolific ransomware-as-a-service (RaaS) operation, now with true cross-platform capabilities targeting Windows, Linux, and VMware ESXi simultaneously. Released on LockBit's sixth anniversary in September 2025, version 5.0 replaces AES encryption with ChaCha20 for faster performance, implements heavy obfuscation via DLL reflection loading, patches ETW (Event Tracing for Windows) to blind defenders, terminates 63+ security services by hash comparison, and features a two-stage encryption strategy (fast-pass 1% followed by full encryption) designed to maximize disruption speed on ESXi hypervisors hosting dozens-to-hundreds of VMs. Most critically, LockBit is consolidating with DragonForce and Qilin in a cartel-style approach that pools affiliates, infrastructure, and playbooks — signaling a shift from individual RaaS brands to an aggregation layer that dramatically increases both capability and scale of ransomware operations. At time of analysis, the ESXi variant had a VirusTotal detection score of 1/65, demonstrating significant evasion capabilities.
How LockBit 5.0 Cross-Platform Ransomware Analysis works
LockBit 5.0 Cross-Platform Ransomware: Post-Cronos Resurgence and Cartel Consolidation
Evolutionary Context — LockBit Version History:
LockBit 1.0 (2019-2020): Initial ransomware with ABCD extension. Basic file encryption. LockBit 2.0 (2021): First Linux variant. StealBit data exfiltration. Automated AD propagation. LockBit 3.0/Black (2022): Based on BlackMatter code. Bug bounty program. Tor-based leak site. LockBit Green (2023): Incorporated Conti source code elements. Expanded affiliate base. Operation Cronos (Feb 2024): International law enforcement disruption. NCA/FBI/Europol seized infrastructure, arrested affiliates, obtained decryption keys. LockBitSupp (Dmitry Yuryevich Khoroshev) charged. LockBit 4.0 (Late 2024): Post-Cronos rebuild. Improved evasion. Limited deployment. LockBit 5.0 (Sep 2025): Full cross-platform release. ChaCha20 encryption. Cartel consolidation with DragonForce/Qilin.
LockBit 5.0 Technical Analysis:
1. Cross-Platform Architecture (Windows + Linux + ESXi): - Windows: DLL reflection loader with heavy obfuscation and packing. Decrypts PE binary in memory. - Linux: 64-bit ELF executable (x86-64). Dynamically linked. Stripped section headers for anti-analysis. - ESXi: Dedicated ESXi Locker v1.07. Validates VMware environment before encryption. Powers off VMs via vim-cmd. - All platforms share: ChaCha20 encryption, randomized 16-character extensions, Russian language/geolocation avoidance. - Consistent CLI across platforms: -d (directories), -f (fast mode), -b (background), -m (note mode), -w (wipe free space).
2. ChaCha20 Encryption Engine: - Replaced AES from previous versions with ChaCha20 stream cipher. - Uses 'expand 32-byte k' constant for state initialization (standard ChaCha20). - Faster than AES on systems without hardware AES acceleration (particularly Linux/ESXi). - Two-stage encryption on ESXi: fast-pass (1% of file) followed by full encryption. - .vmdk.fastpass marker indicates partially-encrypted files during fast-pass stage. - Configurable encryption percentage (-r 10-90) allows affiliates to balance speed vs thoroughness.
3. ESXi-Specific Capabilities: - Environment validation: runs 'vmware -v' to confirm ESXi host. - VM enumeration: 'vim-cmd vmsvc/getallvms' lists all virtual machines. - VM shutdown loop: 'vim-cmd vmsvc/power.off %d' with repeated verification until powered off. - VM bypass list: specific VMs can be excluded by ID (-n flag) — ensures ransom negotiation VM stays operational. - Targeted file types: .vmdk, .vmx, .vswp, .vmem, .vmsn, .vmsd, .vmtx, .vmss, .vmxf, .nvram. - Excluded paths: /proc, /dev, /sys, /bootbank, /altbootbank, /etc, /lib, /bin — keeps hypervisor bootable. - Self-deletion: removes binary after encryption with status logging. - Logging: /var/log/encrypt.log for operator feedback in headless ESXi environment.
4. Anti-Analysis and Defense Evasion: - ETW patching: overwrites EtwEventWrite with 0xC3 (RET instruction) — disables Windows Event Tracing. - Service termination: 63 security service hashes compared at runtime — terminates matching services. - Event log clearing: EvtClearLog API clears all Windows event logs post-encryption. - Anti-debugging (Linux): checks /proc/self/maps and /proc/self/status for TracerPid. - Anti-instrumentation: detects valgrind, frida, strace, ltrace, AddressSanitizer (asan/tsan/msan/ubsan). - No ELF section headers: stripped to complicate static analysis. - DLL reflection loading (Windows): payload decrypted and loaded in memory — never touches disk. - Randomized 16-character extensions: no consistent marker for file-based detection. - 1/65 VirusTotal detection at time of analysis.
5. Cartel Consolidation — Strategic Shift: - LockBit aligning with DragonForce and Qilin in cartel-style umbrella model. - Shared affiliates, infrastructure, and operational playbooks. - Aggregation layer pools resources across multiple RaaS brands. - Implications: defenders face not a single RaaS group but a consortium with diversified capabilities. - If model succeeds: baseline ransomware capability increases industry-wide. - Affiliate mobility between brands reduces impact of disrupting any single operation.
6. Geopolitical Safeguards: - Terminates on Russian language detection (keyboard layout check). - Terminates on Russian geolocation detection. - Consistent with Eastern European cybercriminal safe-harbor operations. - Post-Cronos: LockBitSupp (Khoroshev) charged but remains at large.
7. Code Lineage — Evolution Not Rewrite: - LockBit 5.0 shares identical hashing algorithms with LockBit 4.0. - Same API resolution methods confirm evolution of original codebase. - Not an imitation or fork — authentic continuation of LockBit development. - Incorporates lessons from Conti (Green variant), BlackMatter (3.0/Black), and operational experience.
MITRE ATT&CK techniques used in TL-2026-0062
credential-access
collection
T1005 Data from Local System; T1039 Data from Network Shared Drive
discovery
T1007 System Service Discovery; T1018 Remote System Discovery; T1046 Network Service Discovery; T1069 Permission Groups Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery
lateral-movement
T1021 Remote Services; T1570 Lateral Tool Transfer
defense-evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1055 Process Injection; T1070 Indicator Removal; T1078 Valid Accounts; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion; T1620 Reflective Code Loading; T1622 Debugger Evasion
execution
T1059 Command and Scripting Interpreter; T1106 Native API; T1129 Shared Modules
privilege-escalation
T1068 Exploitation for Privilege Escalation
command-and-control
T1071 Application Layer Protocol; T1090 Proxy
persistence
T1133 External Remote Services; T1543 Create or Modify System Process; T1547 Boot or Logon Autostart Execution
initial-access
T1190 Exploit Public-Facing Application; T1566 Phishing
impact
T1486 Data Encrypted for Impact; T1489 Service Stop; T1490 Inhibit System Recovery; T1529 System Shutdown/Reboot; T1561 Disk Wipe
exfiltration
T1567 Exfiltration Over Web Service
resource-development
T1585 Establish Accounts; T1587 Develop Capabilities; T1588 Obtain Capabilities
defense-impairment
Remediation for LockBit 5.0 Cross-Platform Ransomware Analysis
Patches
- Fortinet FortiOS — patch CVE-2024-55591 and CVE-2024-47575 exploited by LockBit affiliates for initial access
- VMware ESXi — apply all security patches, particularly SSH and authentication-related fixes
- Windows — enforce latest security updates, particularly for NTLM, Kerberos, and RDP vulnerabilities
Immediate actions
- Restrict ESXi SSH access to dedicated management workstations only — SSH is the primary delivery vector for ESXi ransomware
- Enable ESXi lockdown mode to prevent unauthorized remote access to hypervisor shell
- Separate vCenter/ESXi admin accounts from Active Directory — prevents AD compromise from cascading to hypervisor
- Deploy immutable backups (air-gapped or immutable storage) — LockBit specifically targets backup infrastructure
- Monitor for ETW patching: EtwEventWrite function modification indicates active defense evasion
Workarounds
- Kill switch: set system language to Russian (ru-RU) as emergency measure — LockBit 5.0 terminates on Russian language detection
- Monitor for vim-cmd execution patterns: vmsvc/getallvms followed by vmsvc/power.off = active ESXi ransomware
- Deploy canary files (.vmdk, .vmx) that trigger alerts when accessed/modified — early warning for encryption
- Monitor for ChaCha20 'expand 32-byte k' constant in process memory — indicates active encryption engine
Longer-term hardening
- Implement network segmentation isolating ESXi management interfaces from general network
- Deploy application allowlisting on critical servers to prevent unauthorized binary execution
- Enable Credential Guard on Windows endpoints to protect against LSASS credential extraction used in lateral movement
- Migrate to EDR solutions with kernel-level visibility and memory scanning for DLL reflection detection
- Deploy deception technology (honeypots, honey files) to detect ransomware reconnaissance and file enumeration
- Implement ZTNA (Zero Trust Network Access) for remote access — eliminate VPN-based initial access vector
CVEs associated with LockBit 5.0 Cross-Platform Ransomware Analysis
Weaknesses (CWE) in LockBit 5.0 Cross-Platform Ransomware Analysis
CWE-362, CWE-400, CWE-326, CWE-78
Timeline of LockBit 5.0 Cross-Platform Ransomware Analysis
- LockBit 1.0 emerges as ABCD ransomware. Basic file encryption with .abcd extension. Initial RaaS model with affiliate recruitment. Targets Windows systems only. Establishes LockBit as a financially motivated ransomware operation.
- LockBit 2.0 released with first Linux variant and StealBit data exfiltration tool. Automated Active Directory propagation via Group Policy. First cross-platform capability. Affiliate program scales significantly with revenue sharing model.
- LockBit 3.0 (Black) released. Based on BlackMatter source code. Introduces bug bounty program (first for a RaaS). Tor-based leak site with victim timer and negotiation chat. Becomes world's most deployed ransomware variant.
- LockBit Green variant incorporates Conti source code elements after Conti disbanded. Cross-pollination between RaaS operations. Expanded affiliate base absorbs former Conti operators. LockBit becomes umbrella for multiple ransomware codebases.
- Operation Cronos: NCA, FBI, Europol, and 10+ law enforcement agencies disrupt LockBit infrastructure. Seized 34 servers, 200+ crypto wallets, 1,000+ decryption keys. LockBit leak site taken over. Multiple affiliates arrested. LockBitSupp identified as Dmitry Khoroshev (charged May 2024). Biggest-ever ransomware disruption operation.
- U.S. DOJ charges Dmitry Yuryevich Khoroshev as LockBitSupp — LockBit's developer and administrator. $10M reward offered. Russian national, remains at large. Charges include computer fraud, extortion, destruction. 2,500+ victims globally, $500M+ in ransom payments.
- LockBit 4.0 released — post-Cronos rebuild. Improved evasion techniques including ETW patching (documented by 0x0d4y). Limited deployment as LockBit rebuilds affiliate network and infrastructure. Shares code characteristics with eventual v5.0.
- LockBit affiliates exploit Fortinet vulnerabilities (CVE-2024-55591, CVE-2024-47575) for initial access. Forescout documents ransomware operator (Mora_001) using Fortinet VPN exploitation as entry point for LockBit/BlackMatter deployment. VPN exploitation becomes primary initial access vector.
- LockBit 5.0 released on group's sixth anniversary. True cross-platform: Windows (DLL reflection), Linux (ELF x86-64), ESXi (dedicated ESXi Locker v1.07). ChaCha20 encryption replaces AES. Two-stage fast-pass + full encryption. 1/65 VirusTotal detection. Announced on dark web forums.
- LockBit aligns with DragonForce and Qilin in cartel-style umbrella model. Shared affiliates, infrastructure, and operational playbooks. Aggregation layer pools resources across multiple RaaS brands. If model succeeds, defenders face consortium with diversified capabilities rather than individual groups.
- LevelBlue publishes '19 Shades of LockBit 5.0' — comprehensive analysis of 19 samples across Windows, Linux, and ESXi. Details ChaCha20 implementation, ESXi-specific VM shutdown logic, anti-analysis framework (frida/strace/valgrind detection), two-stage encryption, and configurable CLI for affiliate operations.
- Threadlinqs analysis: LockBit 5.0 is not just a ransomware update — it's the foundation for a ransomware cartel. Cross-platform parity (same CLI, same encryption, same evasion across Windows/Linux/ESXi) enables affiliates to attack entire enterprise stacks in a single campaign. The cartel consolidation with DragonForce/Qilin represents the most dangerous structural evolution in ransomware since RaaS itself. One compromised ESXi host = hundreds of encrypted VMs. ChaCha20 + 1/65 detection rate = current AV/EDR is blind. The hypervisor IS the target.
- As of 2026-05-29, LockBit 5.0 is actively operating and escalating: Check Point logged 163 victims in Q1 2026 (+106% QoQ, 4th globally), with a fresh attack on VP Brands International on May 9, 2026. Initial-access CVEs (CVE-2024-55591, CVE-2024-47575) sit in CISA KEV and remain exploited; though Q1 reporting found no cartel merger with DragonForce/Qilin, the group is firmly resurgent post-Cronos.
Sources cited for LockBit 5.0 Cross-Platform Ransomware Analysis
- LevelBlue — 19 Shades of LockBit 5.0: Inside the Latest Cross-Platform Ransomware Part 1
- Trend Micro — New LockBit 5.0 Targets Windows, Linux, ESXi
- Malpedia — LockBit Malware Family
- NCA — Operation Cronos: International LockBit Disruption
- Europol — Law Enforcement Disrupts World's Biggest Ransomware Operation
- KrebsOnSecurity — U.S. Charges Russian Man as Boss of LockBit
- ANALYST1 — LockBit Takedown: Operation Cronos PsyOps Against Ransomware
- DFIR Report — Cobalt Strike and SOCKS Lead to LockBit Ransomware
- Mandiant — M-Trends 2025 Report (LockBit Analysis)
- Forescout — New Ransomware Operator Exploits Fortinet Vulnerability Duo
Threats related to LockBit 5.0 Cross-Platform Ransomware Analysis
- Q1 2026 Ransomware Landscape: Qilin Dominance, LockBit 5.0 Comeback, and FortiGate (CVE-2024-55591) / Oracle EBS (CVE-2025-61882) Mass Exploitation
- Proofpoint AI Era Ransomware Report: 37% of Paying Victims Face Repeat Extortion Demands
- France Threat Landscape: Qilin/MedusaLocker/LockBit Ransomware and NoName057(16) Hacktivist DDoS Campaign Amid 4x Dark Web Activity Surge
- The Gentlemen Ransomware: Worm-Like Self-Propagation and Network-Wide Encryption via Storm-2697's RaaS Affiliate Program
- ChipSoft HiX Healthcare EHR Ransomware Attack — Dutch Hospital Infrastructure Disruption
- Black Basta Ransomware: Internal Chat Leaks Expose $100M+ RaaS Operation — Conti Successor Unmasked
Detection coverage for TL-2026-0062
As of 2026-02-12, Threadlinqs Intelligence publishes 12 detection rule(s) for TL-2026-0062 across Splunk SPL, Microsoft KQL and Sigma, covering 35 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.