baku

lockbit5

activecrime

LockBit 5.0 ("ChuongDong") emerged in September 2025 as the group's resurgence following the February 2024 law enforcement takedown, introducing cross-platform payloads targeting Windows, Linux, and VMware ESXi with enhanced evasion capabilities and continuing the RaaS affiliate model of its predecessors.

observed victims (by country)

United StatesNetherlandsGermanyFrance

observed sectors

ManufacturingProfessional ServicesTechnologyOther

29 victims · last active 31 Aug 2026

recent activity · our intel

lockbit5 → svfcu.org31 Aug 2026 lockbit5 → hoaattorneys.com31 Aug 2026 lockbit5 → bartelsbv.nl31 Aug 2026

source: ransomware.live1 refs →

FAQ2

Which operating systems can LockBit 5.0 target?

LockBit 5.0 uses cross-platform ransomware that targets Windows, Linux, and VMware ESXi platforms.

What should defenders focus on to protect against LockBit 5.0?

Defenders must prioritize hardening Linux servers and ESXi hypervisors, enforce MFA, and maintain regular offline backups.

lockbit5

lockbit5

FAQ2

See also6

lockbit5

lockbit5

FAQ2

See also6