LockBit 5.0 Ransomware Extortion Claim Against US Bank (U.S. Bancorp)

LockBit 5.0 Ransomware Extortion Claim Against US Bank (U.S. (TL-2026-2094), also tracked as Operation ChuongDong, is a high-severity ransomware operation, first published 2026-08-21. It is attributed to LockBit (Russia) with high confidence, affects Microsoft Windows Server, references 8 CVEs (CVE-2023-4966, CVE-2023-0669, CVE-2023-27350), maps to 25 MITRE ATT&CK techniques (T1003, T1021, T1027), and is covered by 9 detection rules and 33 indicators of compromise.

Key facts for TL-2026-2094

Threat ID
TL-2026-2094
Also known as
Operation ChuongDong, LockBit 5.0 Campaign, US Bank LockBit Extortion
Severity
HIGH
Status
ACTIVE
Category
RANSOMWARE
First published
2026-08-21
Last reviewed
2026-08-21
Attribution
LockBit
Attribution confidence
HIGH
Nation-state nexus
Russia
Motivation
FINANCIAL
Target sectors
financial-services, banking
Target regions
North America
Detection rules
9
Indicators of compromise
33

Malware and tooling in LockBit 5.0 Ransomware Extortion Claim Against US Bank (U.S.

Malware and tooling: Cobalt Strike, LockBit, LockBit 5.0 (ChuongDong), MimiKatz, StealBit, AdFind - S0552, Impacket - S0357, LaZagne - S0349, Mimikatz, PSEXEC, Process Hacker, Rclone - S1040

LockBit 5.0 ransomware group claimed to have breached US Bank (U.S. Bancorp, the fifth-largest U.S. commercial bank) and exfiltrated sensitive data, adding the bank to its Tor-based data-leak site on August 19, 2026, with a 14-day extortion deadline of September 3, 2026. US Bank is investigating the claim but states publicly that no evidence of unauthorized internal system access has been found. The group has not disclosed the volume, nature, or contents of the allegedly exfiltrated data. The claim follows LockBit 5.0's re-emergence in September 2025 — internally codenamed 'ChuongDong' — after the February 2024 Operation Cronos law enforcement takedown, and follows a separate false claim against US Bank by the Babuk2 ransomware group in March 2025.

How LockBit 5.0 Ransomware Extortion Claim Against US Bank (U.S. works

On August 19, 2026, the LockBit ransomware group operating its LockBit 5.0 variant added US Bank (U.S. Bancorp, NYSE: USB) to its Tor-based data-leak site, claiming a breach and exfiltration of sensitive data. The group imposed a 14-day extortion deadline of September 3, 2026, threatening to publish the allegedly stolen data if the ransom demand — the amount of which has not been disclosed — is not met. The incident was first reported by GBHackers on August 21, 2026, and covered by The Register on August 20, 2026. US Bank Vice President of Public Affairs Lee Henderson stated that the bank is aware of the claims and is investigating, but that 'at this time, there is no indication that our internal systems have been impacted, and there is no evidence of unauthorized access to our network.' No details regarding the volume, type, or nature of the allegedly exfiltrated data have been provided by LockBit.

US Bank is the fifth-largest commercial bank in the United States, headquartered in Minneapolis, Minnesota, with $692 billion in total assets (as of December 31, 2025), approximately 15 million clients ($13 million consumer, $1.4 million business), 2,075 branches across 26 states, and 70,000 employees. The bank operates four major business lines: Wealth, Corporate, Commercial and Institutional Banking; Consumer and Business Banking; Payment Services (including Elavon merchant processing); and Treasury and Corporate Support. The scale and systemic importance of US Bank makes it a high-value target for ransomware extortion, and any confirmed compromise would have far-reaching implications across the U.S. financial services sector, including potential downstream impacts on merchant processing, payment systems, and customer trust.

This is not the first extortion claim against US Bank. In March 2025, the Babuk2 ransomware group falsely claimed to have breached US Bank and 25 other companies, but cybersecurity researchers assessed the claim as bogus, determining the data was recycled from the Cl0p gang's MOVEit mass-exploitation campaign from 2023. Separately, in May 2026, US Bank began notifying 537 Massachusetts customers that their name, mailing address, and credit card number may have been exposed through a third-party service provider supporting the bank's vendor Fidelity National Information Services (FIS). That incident was not a direct breach of US Bank systems and did not involve Social Security numbers, online banking credentials, or account balances. The temporal proximity of the LockBit extortion claim to the FIS vendor incident raises the possibility of opportunistic extortion by LockBit based on publicly disclosed vendor exposure, a known tactic in the ransomware ecosystem.

LockBit 5.0 (internally codenamed 'ChuongDong') was announced in early September 2025 on the Russian-language cybercrime forum RAMP to mark the group's sixth anniversary, recruiting new affiliates. Check Point Research identified at least a dozen organizations hit by LockBit-branded ransomware within the first month of the 5.0 launch, spanning Western Europe, the Americas, and Asia. LockBit 5.0 is a multi-platform ransomware variant targeting Windows, Linux, and VMware ESXi environments. The Windows variant uses heavy obfuscation and packing, decrypting a PE binary in memory and loading it via DLL reflection techniques that significantly complicate static analysis. The variant incorporates multiple anti-analysis and evasion mechanisms: it patches the EtwEventWrite API with a 0xC3 (RET) instruction to disable Windows Event Tracing for Windows (ETW), terminates 63 security-related services by comparing CRC32-hashed service names against a hardcoded list, and clears event logs post-encryption using the EvtClearLog API. Encrypted files are appended with randomized 16-character hexadecimal file extensions, and the original file size is embedded in the encrypted file footer. The encryptor employs a hybrid encryption scheme using AES (per-file randomly generated key) wrapped with an embedded RSA public key. LockBit 5.0 includes a geolocation check to avoid systems in Russian-speaking regions. The ransom note is dropped as 'ReadMeForDecrypt.txt' and directs victims to personalized Tor-based negotiation links with a 30-day data-publication deadline, along with a 'Chat with Support' interface. The codebase shares identical hashing algorithms and API resolution methods with LockBit 4.0, confirming it is a genuine evolution rather than an imitation.

LockBit operates as a Ransomware-as-a-Service (RaaS) model. The group's administrator, 'LockBitSupp' (identified as Dmitry Yuryevich Khoroshev, who remains at large), manages the platform while affiliates conduct intrusions in exchange for a share of ransom payments. LockBit affiliates typically gain initial access through exploitation of internet-facing applications (Citrix Bleed CVE-2023-4966, Fortra GoAnywhere CVE-2023-0669, PaperCut CVE-2023-27350, Apache Log4j CVE-2021-44228, F5 BIG-IP CVE-2021-22986, among others), phishing/spearphishing campaigns, RDP brute-force, and compromised valid credentials. Post-exploitation activities commonly include credential dumping via Mimikatz and Procdump, Active Directory reconnaissance via AdFind and Nltest, network scanning via SoftPerfect NetScan and Advanced Port Scanner, lateral movement via PsExec, Impacket (wmiexec, smbexec), and RDP, and defense evasion via Process Hacker, Cobalt Strike (delivered via DLL sideloading through VMwareXferlogs.exe or MpCmd.exe), and COM elevation moniker UAC bypass. Data exfiltration is performed using LockBit's custom StealBit tool, Rclone for cloud storage, or FileZilla FTP. Persistence is established through scheduled tasks (UpdateAdobeTask, MEGAcmd) and remote access tools (AnyDesk, Zoho Assist, ScreenConnect, Splashtop, TeamViewer, FixMe IT). The ransomware encrypts from domain controllers using batch scripts propagated via PsExec, deletes volume shadow copies (vssadmin delete shadows /all /quiet & wmic shadowcopy delete), disables Windows recovery (bcdedit /set {default} recoveryenabled no), and prints ransom notes on all connected network printers.

LockBit has been the subject of repeated law enforcement and security community disruptions. On February 20, 2024, Operation Cronos — a coordinated action by the FBI, UK National Crime Agency, Europol, and international partners — seized LockBit's public-facing websites, dark web leak sites, and control servers, seized the StealBit exfiltration platform, obtained decryption keys enabling hundreds of victims to recover encrypted data, and froze over 200 cryptocurrency accounts. The DOJ unsealed indictments against Russian nationals Artur Sungatov and Ivan Kondratyev (Bassterlord) for deploying LockBit, and later indicted Dmitry Khoroshev (LockBitSupp) as the alleged creator and administrator. Despite these disruptions, the group rebuilt and returned with LockBit 5.0 in September 2025. In May 2025, LockBit's own dark web affiliate panels were hacked and defaced with a taunting message ('Don't do crime CRIME IS BAD xoxo from Prague'), leaking 4,442 negotiation chat messages between affiliates and victims (December 2024–April 2025), 59,975 unique Bitcoin addresses, 75 admin and affiliate accounts with plaintext passwords, and build configurations. The breach further damaged the group's reputation but did not halt operations.

The LockBit 5.0 extortion claim against US Bank carries significant implications. If the claim is verified, the breach would expose sensitive financial data of millions of customers, potentially including personally identifiable information (PII), account credentials, and transaction data, with cascading effects across the 15 million client base. The combination of a sophisticated ransomware variant (LockBit 5.0), a high-value target (a top-five U.S. bank), and a hard 14-day deadline creates a high-pressure incident response scenario. Even if the claim proves to be unsubstantiated — a distinct possibility given the absence of evidence found to date, the prior false claim by Babuk2, and the proximity to the FIS vendor notification — the incident underscores the persistent threat LockBit poses to the financial services sector and the risk of reputation-based extortion tactics. The situation remains active as of August 21, 2026, and the outcome — whether data is published on September 3 or the claim is retracted — will have significant consequences for incident response protocols, customer notification obligations, and regulatory scrutiny across the banking industry.

MITRE ATT&CK techniques used in TL-2026-2094

Credential Access

T1003 OS Credential Dumping

Lateral Movement

T1021 Remote Services; T1570 Lateral Tool Transfer

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1055 Process Injection

Discovery

T1033 System Owner/User Discovery; T1046 Network Service Discovery

Exfiltration

T1048 Exfiltration Over Alternative Protocol; T1567 Exfiltration Over Web Service

Persistence

T1053 Scheduled Task/Job; T1543 Create or Modify System Process

Execution

T1059 Command and Scripting Interpreter; T1569 System Services

Command and Control

T1071 Application Layer Protocol; T1219 Remote Access Tools; T1572 Protocol Tunneling

Initial Access

T1078 Valid Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1566 Phishing

defense-impairment

T1112 Modify Registry; T1685 Disable or Modify Tools

Privilege Escalation

T1548 Abuse Elevation Control Mechanism

Collection

T1560 Archive Collected Data

Affected products and versions in LockBit 5.0 Ransomware Extortion Claim Against US Bank (U.S.

  • Microsoft — Windows Server
    Vulnerable versions: 2016; 2019; 2022
  • Microsoft — Windows Desktop
    Vulnerable versions: 10; 11
  • VMware — ESXi
    Vulnerable versions: 7.x; 8.x
  • Linux — Multiple Distributions
    Vulnerable versions: multiple
  • Citrix — NetScaler ADC and Gateway
    Vulnerable versions: 13.0 before 13.0-92.19; 13.1 before 13.1-49.13; 14.1 before 14.1-8.50
    Fixed in: 13.0-92.19+; 13.1-49.13+; 14.1-8.50+

Remediation for LockBit 5.0 Ransomware Extortion Claim Against US Bank (U.S.

Patches

  • Apply latest patches for Citrix NetScaler (CVE-2023-4966 Citrix Bleed)
  • Patch Fortra GoAnywhere MFT (CVE-2023-0669)
  • Patch PaperCut MF/NG (CVE-2023-27350)
  • Patch Apache Log4j (CVE-2021-44228 Log4Shell)
  • Patch F5 BIG-IP (CVE-2021-22986)
  • Address NetLogon elevation (CVE-2020-1472 Zerologon)
  • Patch Microsoft RDS (CVE-2019-0708 BlueKeep)
  • Patch Fortinet FortiOS SSL VPN (CVE-2018-13379)

Immediate actions

  • Block known LockBit-associated C2 IP addresses and domains at perimeter
  • Isolate any systems showing signs of LockBit encryption or ransomware activity
  • Preserve forensic evidence including memory captures, logs, and disk images
  • Engage incident response team and notify relevant authorities (FBI, CISA)
  • Check lockbitvictims.ic3.gov if decryption keys are needed
  • Monitor for RMM tool installation (AnyDesk, Zoho Assist, ScreenConnect, TeamViewer, Splashtop, FixMe IT)

Workarounds

  • Disable RDP if not business-critical; if required, enforce MFA and restrict to VPN
  • Implement network segmentation to isolate critical banking systems
  • Deploy and tune EDR/XDR with behavioral detection for LockBit TTPs
  • Monitor for 16-character hex file extensions and ReadMeForDecrypt.txt ransom note creation
  • Audit for unauthorized RMM software installation
  • Restrict PowerShell execution policy and monitor script block logging
  • Enable and monitor ETW logs for patching attempts
  • Implement application allowlisting to prevent unauthorized binaries

Longer-term hardening

  • Develop and test offline backup and disaster recovery procedures
  • Conduct regular tabletop exercises simulating ransomware extortion scenarios
  • Implement Zero Trust architecture with strict identity verification
  • Establish threat intelligence sharing relationships with financial sector ISACs
  • Deploy deception technology (honeypots, decoy credentials) to detect lateral movement
  • Implement vendor risk management program to monitor third-party security posture

CVEs associated with LockBit 5.0 Ransomware Extortion Claim Against US Bank (U.S.

CVE-2023-4966, CVE-2023-0669, CVE-2023-27350, CVE-2021-44228, CVE-2021-22986, CVE-2020-1472, CVE-2019-0708, CVE-2018-13379

Weaknesses (CWE) in LockBit 5.0 Ransomware Extortion Claim Against US Bank (U.S.

CWE-788, CWE-287, CWE-862, CWE-94, CWE-269, CWE-330, CWE-22

Timeline of LockBit 5.0 Ransomware Extortion Claim Against US Bank (U.S.

  • Operation Cronos: FBI, UK NCA, and international partners seize LockBit's public-facing websites, dark web infrastructure, and control servers; obtain decryption keys enabling hundreds of victims to recover encrypted data; seize StealBit platform; freeze over 200 cryptocurrency accounts. DOJ unseals indictments of Artur Sungatov and Ivan Kondratyev (Bassterlord).
  • DOJ unseals indictment of Dmitry Yuryevich Khoroshev (aka LockBitSupp, putinkrab) as the alleged creator and administrator of LockBit ransomware. Treasury Department imposes sanctions. Khoroshev remains at large.
  • Evolve Bank & Trust data breach: LockBit affiliate breaches the Arkansas-based bank via a phishing link, exfiltrating data on 7.6 million individuals including names, SSNs, and bank account numbers. LockBit mistakenly claims to have hacked the U.S. Federal Reserve.
  • Babuk2 ransomware group falsely claims to have breached US Bank and 25 other organizations. Cybersecurity researchers assess the claim as bogus — the data is recycled from the Cl0p gang's MOVEit mass-exploitation campaign from 2023.
  • LockBit's dark web affiliate panels are hacked and defaced with a taunting message ('Don't do crime CRIME IS BAD xoxo from Prague'). MySQL database dump from ~April 29, 2025 leaks 4,442 negotiation messages (Dec 2024–Apr 2025), 59,975 Bitcoin addresses, 75 admin/affiliate accounts with plaintext passwords, and build configurations.
  • LockBit officially announces its return on the Russian-language cybercrime forum RAMP, unveiling LockBit 5.0 (internally codenamed 'ChuongDong') to mark the group's sixth anniversary, and begins recruiting new affiliates with a $500 BTC deposit requirement.
  • Trend Micro publishes technical analysis of LockBit 5.0 confirming multi-platform support (Windows, Linux, ESXi), DLL reflection loading, ETW patching, 63 security service terminations, randomized 16-character hex file extensions, AES/RSA hybrid encryption, and Russian language geolocation checks.
  • Check Point Research identifies at least a dozen organizations hit by LockBit-branded ransomware in September 2025, half infected with LockBit 5.0 and half with LockBit 3.0 (LockBit Black). Victims span Western Europe, the Americas, and Asia with ~65% targeting U.S. organizations.
  • U.S. Bank is notified that a third-party service provider supporting its vendor Fidelity National Information Services (FIS) experienced a security incident. On May 19, 2026, US Bank confirms that certain customer credit-card data was impacted.
  • US Bank begins mailing notification letters to 537 Massachusetts customers whose name, mailing address, and credit card number may have been exposed through the FIS vendor incident. Social Security numbers, online banking credentials, and account balances were not involved. Bank offers 12 months of complimentary credit monitoring.
  • LockBit 5.0 ransomware group adds US Bank to its Tor-based data-leak site, claiming a breach and exfiltration of sensitive data, imposing a 14-day extortion deadline of September 3, 2026. No data volume, file types, or specific exfiltration details are disclosed.
  • The Register publishes coverage of the LockBit extortion claim against US Bank. US Bank VP of Public Affairs Lee Henderson states the bank is aware of the claims and investigating but finds no evidence of unauthorized internal system access.
  • GBHackers publishes detailed coverage of the LockBit extortion claim. US Bank continues to investigate. The claim remains unverified. The threat intelligence community notes the temporal proximity to the FIS vendor notification and the prior Babuk2 false claim as potential indicators of opportunistic extortion rather than a confirmed breach.
  • LockBit's 14-day extortion deadline for US Bank. Unless the ransom is paid or the deadline is extended, LockBit is expected to publish the allegedly exfiltrated data on its leak site. The outcome — whether data is published or the claim is retracted — will determine the next phase of this incident.

Sources cited for LockBit 5.0 Ransomware Extortion Claim Against US Bank (U.S.

Threats related to LockBit 5.0 Ransomware Extortion Claim Against US Bank (U.S.

Detection coverage for TL-2026-2094

As of 2026-08-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2094 across Splunk SPL, Microsoft KQL and Sigma, covering 33 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Community OSINT corroboration for TL-2026-2094

1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats