# LockBit 5.0 Ransomware Extortion Claim Against US Bank (U.S. Bancorp)

> LockBit 5.0 ransomware group claimed to have breached US Bank (U.S. Bancorp, the fifth-largest U.S. commercial bank) and exfiltrated sensitive data, adding the bank to its Tor-based data-leak site on August 19, 2026, with a 14-day extortion deadline of September 3, 2026. US Bank is investigating the claim but states publicly that no evidence of unauthorized internal system access has been found. The group has not disclosed the volume, nature, or contents of the allegedly exfiltrated data. The claim follows LockBit 5.0's re-emergence in September 2025 — internally codenamed 'ChuongDong' — after the February 2024 Operation Cronos law enforcement takedown, and follows a separate false claim against US Bank by the Babuk2 ransomware group in March 2025.

- **Published:** 2026-08-21T00:00:00Z
- **Last reviewed:** 2026-08-21T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2094
- **ID:** TL-2026-2094
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** LockBit (Russia)
- **Detections:** 9 · **IOCs:** 33 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2023-4966, CVE-2023-0669, CVE-2023-27350, CVE-2021-44228, CVE-2021-22986, CVE-2020-1472, CVE-2019-0708, CVE-2018-13379

## Description

On August 19, 2026, the LockBit ransomware group operating its LockBit 5.0 variant added US Bank (U.S. Bancorp, NYSE: USB) to its Tor-based data-leak site, claiming a breach and exfiltration of sensitive data. The group imposed a 14-day extortion deadline of September 3, 2026, threatening to publish the allegedly stolen data if the ransom demand — the amount of which has not been disclosed — is not met. The incident was first reported by GBHackers on August 21, 2026, and covered by The Register on August 20, 2026. US Bank Vice President of Public Affairs Lee Henderson stated that the bank is aware of the claims and is investigating, but that 'at this time, there is no indication that our internal systems have been impacted, and there is no evidence of unauthorized access to our network.' No details regarding the volume, type, or nature of the allegedly exfiltrated data have been provided by LockBit.

US Bank is the fifth-largest commercial bank in the United States, headquartered in Minneapolis, Minnesota, with $692 billion in total assets (as of December 31, 2025), approximately 15 million clients ($13 million consumer, $1.4 million business), 2,075 branches across 26 states, and 70,000 employees. The bank operates four major business lines: Wealth, Corporate, Commercial and Institutional Banking; Consumer and Business Banking; Payment Services (including Elavon merchant processing); and Treasury and Corporate Support. The scale and systemic importance of US Bank makes it a high-value target for ransomware extortion, and any confirmed compromise would have far-reaching implications across the U.S. financial services sector, including potential downstream impacts on merchant processing, payment systems, and customer trust.

This is not the first extortion claim against US Bank. In March 2025, the Babuk2 ransomware group falsely claimed to have breached US Bank and 25 other companies, but cybersecurity researchers assessed the claim as bogus, determining the data was recycled from the Cl0p gang's MOVEit mass-exploitation campaign from 2023. Separately, in May 2026, US Bank began notifying 537 Massachusetts customers that their name, mailing address, and credit card number may have been exposed through a third-party service provider supporting the bank's vendor Fidelity National Information Services (FIS). That incident was not a direct breach of US Bank systems and did not involve Social Security numbers, online banking credentials, or account balances. The temporal proximity of the LockBit extortion claim to the FIS vendor incident raises the possibility of opportunistic extortion by LockBit based on publicly disclosed vendor exposure, a known tactic in the ransomware ecosystem.

LockBit 5.0 (internally codenamed 'ChuongDong') was announced in early September 2025 on the Russian-language cybercrime forum RAMP to mark the group's sixth anniversary, recruiting new affiliates. Check Point Research identified at least a dozen organizations hit by LockBit-branded ransomware within the first month of the 5.0 launch, spanning Western Europe, the Americas, and Asia. LockBit 5.0 is a multi-platform ransomware variant targeting Windows, Linux, and VMware ESXi environments. The Windows variant uses heavy obfuscation and packing, decrypting a PE binary in memory and loading it via DLL reflection techniques that significantly complicate static analysis. The variant incorporates multiple anti-analysis and evasion mechanisms: it patches the EtwEventWrite API with a 0xC3 (RET) instruction to disable Windows Event Tracing for Windows (ETW), terminates 63 security-related services by comparing CRC32-hashed service names against a hardcoded list, and clears event logs post-encryption using the EvtClearLog API. Encrypted files are appended with randomized 16-character hexadecimal file extensions, and the original file size is embedded in the encrypted file footer. The encryptor employs a hybrid encryption scheme using AES (per-file randomly generated key) wrapped with an embedded RSA public key. LockBit 5.0 includes a geolocation check to avoid systems in Russian-speaking regions. The ransom note is dropped as 'ReadMeForDecrypt.txt' and directs victims to personalized Tor-based negotiation links with a 30-day data-publication deadline, along with a 'Chat with Support' interface. The codebase shares identical hashing algorithms and API resolution methods with LockBit 4.0, confirming it is a genuine evolution rather than an imitation.

LockBit operates as a Ransomware-as-a-Service (RaaS) model. The group's administrator, 'LockBitSupp' (identified as Dmitry Yuryevich Khoroshev, who remains at large), manages the platform while affiliates conduct intrusions in exchange for a share of ransom payments. LockBit affiliates typically gain initial access through exploitation of internet-facing applications (Citrix Bleed CVE-2023-4966, Fortra GoAnywhere CVE-2023-0669, PaperCut CVE-2023-27350, Apache Log4j CVE-2021-44228, F5 BIG-IP CVE-2021-22986, among others), phishing/spearphishing campaigns, RDP brute-force, and compromised valid credentials. Post-exploitation activities commonly include credential dumping via Mimikatz and Procdump, Active Directory reconnaissance via AdFind and Nltest, network scanning via SoftPerfect NetScan and Advanced Port Scanner, lateral movement via PsExec, Impacket (wmiexec, smbexec), and RDP, and defense evasion via Process Hacker, Cobalt Strike (delivered via DLL sideloading through VMwareXferlogs.exe or MpCmd.exe), and COM elevation moniker UAC bypass. Data exfiltration is performed using LockBit's custom StealBit tool, Rclone for cloud storage, or FileZilla FTP. Persistence is established through scheduled tasks (UpdateAdobeTask, MEGAcmd) and remote access tools (AnyDesk, Zoho Assist, ScreenConnect, Splashtop, TeamViewer, FixMe IT). The ransomware encrypts from domain controllers using batch scripts propagated via PsExec, deletes volume shadow copies (vssadmin delete shadows /all /quiet & wmic shadowcopy delete), disables Windows recovery (bcdedit /set {default} recoveryenabled no), and prints ransom notes on all connected network printers.

LockBit has been the subject of repeated law enforcement and security community disruptions. On February 20, 2024, Operation Cronos — a coordinated action by the FBI, UK National Crime Agency, Europol, and international partners — seized LockBit's public-facing websites, dark web leak sites, and control servers, seized the StealBit exfiltration platform, obtained decryption keys enabling hundreds of victims to recover encrypted data, and froze over 200 cryptocurrency accounts. The DOJ unsealed indictments against Russian nationals Artur Sungatov and Ivan Kondratyev (Bassterlord) for deploying LockBit, and later indicted Dmitry Khoroshev (LockBitSupp) as the alleged creator and administrator. Despite these disruptions, the group rebuilt and returned with LockBit 5.0 in September 2025. In May 2025, LockBit's own dark web affiliate panels were hacked and defaced with a taunting message ('Don't do crime CRIME IS BAD xoxo from Prague'), leaking 4,442 negotiation chat messages between affiliates and victims (December 2024–April 2025), 59,975 unique Bitcoin addresses, 75 admin and affiliate accounts with plaintext passwords, and build configurations. The breach further damaged the group's reputation but did not halt operations.

The LockBit 5.0 extortion claim against US Bank carries significant implications. If the claim is verified, the breach would expose sensitive financial data of millions of customers, potentially including personally identifiable information (PII), account credentials, and transaction data, with cascading effects across the 15 million client base. The combination of a sophisticated ransomware variant (LockBit 5.0), a high-value target (a top-five U.S. bank), and a hard 14-day deadline creates a high-pressure incident response scenario. Even if the claim proves to be unsubstantiated — a distinct possibility given the absence of evidence found to date, the prior false claim by Babuk2, and the proximity to the FIS vendor notification — the incident underscores the persistent threat LockBit poses to the financial services sector and the risk of reputation-based extortion tactics. The situation remains active as of August 21, 2026, and the outcome — whether data is published on September 3 or the claim is retracted — will have significant consequences for incident response protocols, customer notification obligations, and regulatory scrutiny across the banking industry.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1566 Phishing
- T1133 External Remote Services
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1569 System Services
- T1053 Scheduled Task/Job
- T1543 Create or Modify System Process
- T1548 Abuse Elevation Control Mechanism
- T1685 Disable or Modify Tools
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1055 Process Injection
- T1112 Modify Registry
- T1003 OS Credential Dumping
- T1046 Network Service Discovery
- T1033 System Owner/User Discovery
- T1021 Remote Services
- T1570 Lateral Tool Transfer
- T1560 Archive Collected Data
- T1219 Remote Access Tools
- T1572 Protocol Tunneling
- T1071 Application Layer Protocol
- T1048 Exfiltration Over Alternative Protocol
- T1567 Exfiltration Over Web Service

## Sources

- [US Bank Investigates Alleged Data Breach After LockBit Ransomware Extortion Claim](https://gbhackers.com/us-bank-investigates-alleged-data-breach/)
- [The Register: US Bank investigates LockBit's claims as ransomware criminals set pay-or-leak deadline](https://www.theregister.com/security/2026/08/20/us-bank-investigates-lockbits-claims-as-ransomware-crims-set-pay-or-leak-deadline/)
- [Trend Micro: New LockBit 5.0 Targets Windows, Linux, ESXi](https://www.trendmicro.com/en/research/25/i/lockbit-5-targets-windows-linux-esxi.html)
- [Check Point Research: LockBit 5.0 — Ransomware Gang Returns in Force](https://research.checkpoint.com/2025/lockbit-returns-and-it-already-has-victims/)
- [Infosecurity Magazine: New LockBit Ransomware Victims Identified](https://www.infosecurity-magazine.com/news/new-lockbit-ransomware-victims/)
- [BleepingComputer: LockBit Ransomware Gang Hacked — Victim Negotiations Exposed](https://www.bleepingcomputer.com/news/security/lockbit-ransomware-gang-hacked-victim-negotiations-exposed/)
- [CISA AA23-165A: Understanding Ransomware Threat Actors — LockBit](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-165a)
- [CISA AA23-075A: #StopRansomware — LockBit 3.0](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-075a)
- [CISA AA23-325A: LockBit 3.0 Affiliates Exploit CVE-2023-4966 Citrix Bleed](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a)
- [DOJ: U.S. and U.K. Disrupt LockBit Ransomware Variant (Operation Cronos)](https://www.justice.gov/archives/opa/pr/us-and-uk-disrupt-lockbit-ransomware-variant)
- [DOJ: LockBit Case Page — District of New Jersey](https://www.justice.gov/usao-nj/lockbit)
- [Secureworks: Unpicking LockBit — 22 Cases of Affiliate Tradecraft](https://www.secureworks.com/blog/lockbit-in-action)
- [CrowdStrike: How CrowdStrike Prevents Volume Shadow Tampering by LockBit](https://www.crowdstrike.com/en-us/blog/how-crowdstrike-prevents-volume-shadow-tampering-by-lockbit-ransomware/)
- [Trend Micro: LockBit 5.0 IOC Text File](https://documents.trendmicro.com/images/uploads/20250924%20New%20LockBit%205.0%20Targets%20Multiple%20Platforms-70jqtcf.txt)
- [BankInfoSecurity: Fake Out — Babuk2 Ransomware Group Claims Bogus Victims](https://www.bankinfosecurity.com/blogs/fake-out-babuk2-ransomware-group-claims-bogus-victims-p-3840)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2094