LockBit 5.0 Cross-Platform Ransomware Analysis — Threadlinqs Intelligence
As of 2026-05-30, LockBit 5.0 Cross-Platform Ransomware Analysis is a critical-severity ransomware threat attributed to LockBit (Russia), tracked by Threadlinqs Intelligence with 12 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 35 indicators of compromise.
Threat ID: TL-2026-0062 · Severity: CRITICAL · Status: ACTIVE · Category: RANSOMWARE
Attribution: LockBit · Russia · FINANCIAL
LockBit 5.0 represents the post-Operation Cronos resurgence of the world's most prolific ransomware-as-a-service (RaaS) operation, now with true cross-platform capabilities targeting Windows, Linux,
LockBit 5.0 Cross-Platform Ransomware: Post-Cronos Resurgence and Cartel Consolidation
Evolutionary Context — LockBit Version History:
LockBit 1.0 (2019-2020): Initial ransomware with ABCD extension. Basic file encryption.
LockBit 2.0 (2021): First Linux variant. StealBit data exfiltration. Automated AD propagation.
LockBit 3.0/Black (2022): Based on BlackMatter code. Bug bounty program. Tor-based leak site.
LockBit Green (2023): Incorporated Conti source code elements. Expanded affiliate base.
Operation Cronos (Feb 2024): International law enforcement disruption. NCA/FBI/Europol seized infrastructure, arrested affiliates, obtained decryption keys. LockBitSupp (Dmitry Yuryevich Khoroshev) charged.
LockBit 4.0 (Late 2024): Post-Cronos rebuild. Improved evasion. Limited deployment.
LockBit 5.0 (Sep 2025): Full cross-platform release. ChaCha20 encryption. Cartel consolidation with DragonForce/Qilin.
LockBit 5.0 Technical Analysis:
1. Cross-Platform Architecture (Windows + Linux + ESXi):
- Windows: DLL reflection loader with heavy obfuscation and packing. Decrypts PE binary in memory.
- Linux: 64-bit ELF executable (x86-64). Dynamically linked. Stripped section headers for anti-analysis.
- ESXi: Dedicated ESXi Locker v1.07. Validates VMware environment before encryption. Powers off VMs via vim-cmd.
- All platforms share: ChaCha20 encryption, randomized 16-character extensions, Russian language/geolocation avoidance.
- Consistent CLI across platforms: -d (directories), -f (fast mode), -b (background), -m (note mode), -w (wipe free space).
2. ChaCha20 Encryption Engine:
- Replaced AES from previous versions with ChaCha20 stream cipher.
- Uses 'expand 32-byte k' constant for state initialization (standard ChaCha20).
- Faster than AES on systems without hardware AES acceleration (particularly Linux/ESXi).
- Two-stage encryption on ESXi: fast-pass (1% of file) followed by full encryption.
- .vmdk.fastpass marker indicates partially-encrypted files during fast-pass stage.
- Configurable encryption percentage (-r 10-90) allows affiliates to balance speed vs thoroughness.
3. ESXi-Specific Capabilities:
- Environment validation: runs 'vmware -v' to confirm ESXi host.
- VM enumeration: 'vim-cmd vmsvc/getallvms' lists all virtual machines.
- VM shutdown loop: 'vim-cmd vmsvc/power.off %d' with repeated verification until powered off.
- VM bypass list: specific VMs can be excluded by ID (-n flag) — ensures ransom negotiation VM stays operational.
- Targeted file types: .vmdk, .vmx, .vswp, .vmem, .vmsn, .vmsd, .vmtx, .vmss, .vmxf, .nvram.
- Excluded paths: /proc, /dev, /sys, /bootbank, /altbootbank, /etc, /lib, /bin — keeps hypervisor bootable.
- Self-deletion: removes binary after encryption with status logging.
- Logging: /var/log/encrypt.log for operator feedback in headless ESXi environment.
4. Anti-Analysis and Defense Evasion:
- ETW patching: overwrites EtwEventWrite with 0xC3 (RET instruction) — disables Windows Event Tracing.
- Service termination: 63 security service hashes compared at runtime — terminates matching services.
- Event log clearing: EvtClearLog API clears all Windows event logs post-encryption.
- Anti-debugging (Linux): checks /proc/self/maps and /proc/self/status for TracerPid.
- Anti-instrumentation: detects valgrind, frida, strace, ltrace, AddressSanitizer (asan/tsan/msan/ubsan).
- No ELF section headers: stripped to complicate static analysis.
- DLL reflection loading (Windows): payload decrypted and loaded in memory — never touches disk.
- Randomized 16-character extensions: no consistent marker for file-based detection.
- 1/65 VirusTotal detection at time of analysis.
5. Cartel Consolidation — Strategic Shift:
- LockBit aligning with DragonForce and Qilin in cartel-style umbrella model.
- Shared affiliates, infrastructure, and operational playbooks.
- Aggregation layer pools resources across multiple RaaS brands.
- Implications: defenders face not a single RaaS group but a consortium with diversified capabil
Weaknesses (CWE)
CWE-362, CWE-400, CWE-326, CWE-78
Target sectors: All Sectors, Healthcare, Government, Financial Services, Manufacturing, Technology, Education, Critical Infrastructure
Target regions: Global (excludes Russia and CIS)
Detections & IOCs
As of 2026-07-28, this threat has 12 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 35 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
RANSOMWARE, CRITICAL, threat intelligence, cybersecurity, CVE-2024-55591, CVE-2024-47575, T1059, T1059, T1106, T1078, T1068, T1620, T1562, T1070, T1027, T1497