# LockBit 5.0 Cross-Platform Ransomware Analysis

> LockBit 5.0 represents the post-Operation Cronos resurgence of the world's most prolific ransomware-as-a-service (RaaS) operation, now with true cross-platform capabilities targeting Windows, Linux, and VMware ESXi simultaneously. Released on LockBit's sixth anniversary in September 2025, version 5.0 replaces AES encryption with ChaCha20 for faster performance, implements heavy obfuscation via DLL reflection loading, patches ETW (Event Tracing for Windows) to blind defenders, terminates 63+ security services by hash comparison, and features a two-stage encryption strategy (fast-pass 1% followed by full encryption) designed to maximize disruption speed on ESXi hypervisors hosting dozens-to-hundreds of VMs. Most critically, LockBit is consolidating with DragonForce and Qilin in a cartel-style approach that pools affiliates, infrastructure, and playbooks — signaling a shift from individual RaaS brands to an aggregation layer that dramatically increases both capability and scale of ransomware operations. At time of analysis, the ESXi variant had a VirusTotal detection score of 1/65, demonstrating significant evasion capabilities.

- **Published:** 2026-02-12T04:24:17Z
- **Last reviewed:** 2026-02-12T04:24:17Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0062
- **ID:** TL-2026-0062
- **Severity:** CRITICAL
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** LockBit (Russia)
- **Detections:** 12 · **IOCs:** 35 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2024-55591, CVE-2024-47575

## Description

LockBit 5.0 Cross-Platform Ransomware: Post-Cronos Resurgence and Cartel Consolidation

Evolutionary Context — LockBit Version History:

LockBit 1.0 (2019-2020): Initial ransomware with ABCD extension. Basic file encryption.
LockBit 2.0 (2021): First Linux variant. StealBit data exfiltration. Automated AD propagation.
LockBit 3.0/Black (2022): Based on BlackMatter code. Bug bounty program. Tor-based leak site.
LockBit Green (2023): Incorporated Conti source code elements. Expanded affiliate base.
Operation Cronos (Feb 2024): International law enforcement disruption. NCA/FBI/Europol seized infrastructure, arrested affiliates, obtained decryption keys. LockBitSupp (Dmitry Yuryevich Khoroshev) charged.
LockBit 4.0 (Late 2024): Post-Cronos rebuild. Improved evasion. Limited deployment.
LockBit 5.0 (Sep 2025): Full cross-platform release. ChaCha20 encryption. Cartel consolidation with DragonForce/Qilin.

LockBit 5.0 Technical Analysis:

1. Cross-Platform Architecture (Windows + Linux + ESXi):
- Windows: DLL reflection loader with heavy obfuscation and packing. Decrypts PE binary in memory.
- Linux: 64-bit ELF executable (x86-64). Dynamically linked. Stripped section headers for anti-analysis.
- ESXi: Dedicated ESXi Locker v1.07. Validates VMware environment before encryption. Powers off VMs via vim-cmd.
- All platforms share: ChaCha20 encryption, randomized 16-character extensions, Russian language/geolocation avoidance.
- Consistent CLI across platforms: -d (directories), -f (fast mode), -b (background), -m (note mode), -w (wipe free space).

2. ChaCha20 Encryption Engine:
- Replaced AES from previous versions with ChaCha20 stream cipher.
- Uses 'expand 32-byte k' constant for state initialization (standard ChaCha20).
- Faster than AES on systems without hardware AES acceleration (particularly Linux/ESXi).
- Two-stage encryption on ESXi: fast-pass (1% of file) followed by full encryption.
- .vmdk.fastpass marker indicates partially-encrypted files during fast-pass stage.
- Configurable encryption percentage (-r 10-90) allows affiliates to balance speed vs thoroughness.

3. ESXi-Specific Capabilities:
- Environment validation: runs 'vmware -v' to confirm ESXi host.
- VM enumeration: 'vim-cmd vmsvc/getallvms' lists all virtual machines.
- VM shutdown loop: 'vim-cmd vmsvc/power.off %d' with repeated verification until powered off.
- VM bypass list: specific VMs can be excluded by ID (-n flag) — ensures ransom negotiation VM stays operational.
- Targeted file types: .vmdk, .vmx, .vswp, .vmem, .vmsn, .vmsd, .vmtx, .vmss, .vmxf, .nvram.
- Excluded paths: /proc, /dev, /sys, /bootbank, /altbootbank, /etc, /lib, /bin — keeps hypervisor bootable.
- Self-deletion: removes binary after encryption with status logging.
- Logging: /var/log/encrypt.log for operator feedback in headless ESXi environment.

4. Anti-Analysis and Defense Evasion:
- ETW patching: overwrites EtwEventWrite with 0xC3 (RET instruction) — disables Windows Event Tracing.
- Service termination: 63 security service hashes compared at runtime — terminates matching services.
- Event log clearing: EvtClearLog API clears all Windows event logs post-encryption.
- Anti-debugging (Linux): checks /proc/self/maps and /proc/self/status for TracerPid.
- Anti-instrumentation: detects valgrind, frida, strace, ltrace, AddressSanitizer (asan/tsan/msan/ubsan).
- No ELF section headers: stripped to complicate static analysis.
- DLL reflection loading (Windows): payload decrypted and loaded in memory — never touches disk.
- Randomized 16-character extensions: no consistent marker for file-based detection.
- 1/65 VirusTotal detection at time of analysis.

5. Cartel Consolidation — Strategic Shift:
- LockBit aligning with DragonForce and Qilin in cartel-style umbrella model.
- Shared affiliates, infrastructure, and operational playbooks.
- Aggregation layer pools resources across multiple RaaS brands.
- Implications: defenders face not a single RaaS group but a consortium with diversified capabilities.
- If model succeeds: baseline ransomware capability increases industry-wide.
- Affiliate mobility between brands reduces impact of disrupting any single operation.

6. Geopolitical Safeguards:
- Terminates on Russian language detection (keyboard layout check).
- Terminates on Russian geolocation detection.
- Consistent with Eastern European cybercriminal safe-harbor operations.
- Post-Cronos: LockBitSupp (Khoroshev) charged but remains at large.

7. Code Lineage — Evolution Not Rewrite:
- LockBit 5.0 shares identical hashing algorithms with LockBit 4.0.
- Same API resolution methods confirm evolution of original codebase.
- Not an imitation or fork — authentic continuation of LockBit development.
- Incorporates lessons from Conti (Green variant), BlackMatter (3.0/Black), and operational experience.

## MITRE ATT&CK

- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1078 Valid Accounts
- T1068 Exploitation for Privilege Escalation
- T1620 Reflective Code Loading
- T1685 Disable or Modify Tools
- T1070 Indicator Removal
- T1027 Obfuscated Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1622 Debugger Evasion
- T1003 OS Credential Dumping
- T1082 System Information Discovery
- T1046 Network Service Discovery
- T1007 System Service Discovery
- T1021 Remote Services
- T1570 Lateral Tool Transfer
- T1005 Data from Local System
- T1567 Exfiltration Over Web Service
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery
- T1489 Service Stop
- T1529 System Shutdown/Reboot
- T1071 Application Layer Protocol
- T1090 Proxy
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1566 Phishing
- T1587 Develop Capabilities
- T1129 Shared Modules
- T1547 Boot or Logon Autostart Execution
- T1543 Create or Modify System Process
- T1036 Masquerading
- T1055 Process Injection
- T1140 Deobfuscate/Decode Files or Information
- T1083 File and Directory Discovery
- T1069 Permission Groups Discovery
- T1018 Remote System Discovery
- T1039 Data from Network Shared Drive
- T1561 Disk Wipe
- T1588 Obtain Capabilities

## Sources

- [LevelBlue — 19 Shades of LockBit 5.0: Inside the Latest Cross-Platform Ransomware Part 1](https://www.levelblue.com/blogs/spiderlabs-blog/19-shades-of-lockbit5.0-inside-the-latest-cross-platform-ransomware-part-1)
- [Trend Micro — New LockBit 5.0 Targets Windows, Linux, ESXi](https://www.trendmicro.com/en_us/research/25/i/lockbit-5-targets-windows-linux-esxi.html)
- [Malpedia — LockBit Malware Family](https://malpedia.caad.fkie.fraunhofer.de/details/win.lockbit)
- [NCA — Operation Cronos: International LockBit Disruption](https://www.nationalcrimeagency.gov.uk/news/nca-leads-international-investigation-targeting-worlds-most-harmful-ransomware-group)
- [Europol — Law Enforcement Disrupts World's Biggest Ransomware Operation](https://www.europol.europa.eu/media-press/newsroom/news/law-enforcement-disrupt-worlds-biggest-ransomware-operation)
- [KrebsOnSecurity — U.S. Charges Russian Man as Boss of LockBit](https://krebsonsecurity.com/2024/05/u-s-charges-russian-man-as-boss-of-lockbit-ransomware-group/)
- [ANALYST1 — LockBit Takedown: Operation Cronos PsyOps Against Ransomware](https://analyst1.com/lockbit-takedown-operation-cronos-a-long-awaited-psyops-against-ransomware/)
- [DFIR Report — Cobalt Strike and SOCKS Lead to LockBit Ransomware](https://thedfirreport.com/2025/01/27/cobalt-strike-and-a-pair-of-socks-lead-to-lockbit-ransomware/)
- [Mandiant — M-Trends 2025 Report (LockBit Analysis)](https://services.google.com/fh/files/misc/m-trends-2025-en.pdf)
- [Forescout — New Ransomware Operator Exploits Fortinet Vulnerability Duo](https://www.forescout.com/blog/new-ransomware-operator-exploits-fortinet-vulnerability-duo/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0062