New LockBit 5.0 variant is a cross-platform ransomware nightmare
LockBit is the notorious ransomware gang responsible for running one of the world's most dangerous Ransomware-as-a-Service (RaaS) platforms. Now, LockBit has reportedly returned with LockBit 5.0, a new variant of the group's ransomware that's already in active use.
In early 2024, a task force of law enforcement agencies conducted Operation Cronos, which took down several big pieces of infrastructure from the prolific ransomware group. As an RaaS provider, the group sold tools and software that affiliates could use for their own hacking operations. It was seen as a major victory at the time. Well over a year later, it seems LockBit is back and, according to a technical analysis by Trend Micro, that isn’t good news.
In early September, LockBit announced a new version of its ransomware software, LockBit 5.0. Since then, Trend Micro researchers have been looking for examples of LockBit 5.0 being used in the wild, so to speak. Not only was the company able to find examples on Windows, Linux, and ESXi (virtual machines), but its analysis of LockBit Version 5.0 showed that it’s the most advanced ransomware the group has made yet.
You May Also Like
Apple AirPods Pro 3 Noise Cancelling Heart Rate Wireless Earbuds — $219.99 (List Price $249.00)
Apple iPad 11" 128GB Wi-Fi Retina Tablet (Blue, 2025 Release) — $274.00 (List Price $349.00)
Amazon Fire HD 10 32GB Tablet (2023 Release, Black) — $69.99 (List Price $139.99)
Sony WH-1000XM5 Wireless Noise Canceling Headphones — $248.00 (List Price $399.99)
Blink Outdoor 4 1080p Security Camera (5-Pack) — $159.99 (List Price $399.99)
Fire TV Stick 4K Streaming Device With Remote (2023 Model) — $24.99 (List Price $49.99)
Shark AV2511AE AI Robot Vacuum With XL Self-Empty Base — $249.99 (List Price $599.00)
Apple Watch Series 11 (GPS, 42mm, S/M Black Sport Band) — $339.00 (List Price $399.00)
WD 6TB My Passport USB 3.0 Portable External Hard Drive — $138.65 (List Price $179.99)
Dell 14 Premium Intel Ultra 7 512GB SSD 16GB RAM 2K Laptop — $999.99 (List Price $1549.99)
Per Trend Micro, version 5.0 shares some common elements with version 4.0, meaning it's an evolution rather than an entirely new piece of ransomware. The new version adds horrible features like a DLL reflection (the ability to load a DLL from memory), a few new anti-analysis techniques, and — for the Linux variant anyway — the ability to use the command line to target specific directories and file types. All versions also add a random 16-bit string to make getting your data back that much harder.
Once the ransomware takes control of your computer, it seems to behave the same way that prior LockBit versions did, where you get a ransom note in a text file with instructions on where to go to pay your ransom. There is also the option to “chat with support” to negotiate the ransom.
In addition to the technical details, it’s been reported that LockBit’s affiliate incentive model has been refreshed, giving bad actors even more incentive to use the software. Reportedly, the refresh was meant to recruit people back to LockBit after the service disruption caused by Operation Cronos last year.
With LockBit back in action, it joins a new generation of AI-powered ransomware that hit the market in late summer 2025, also known as PromptLock. So, if you haven’t been keeping up to speed on the latest cybersecurity threats and scams, now is a great time to refresh yourself on how to be safe on the Internet.
Topics Apps & Software Cybersecurity
