🇷🇺 LockBit¶
Threat-actor battle card · maintained from public sources · last updated 2026-10-23 · also known as LockBit 5.0, ABCD (origin)
Overview¶
LockBit emerged in 2019 (initially "ABCD") and industrialised RaaS at scale before Operation Cronos seized its infrastructure in February 2024. It rebuilt within weeks; LockBit 5.0 was announced on the RAMP forum in September 2025 (the group's six-year anniversary) and a Christmas-themed 5.0 DLS launched December 2025, quickly posting 100+ alleged victims. Active member of the Qilin/LockBit/DragonForce ransomware cartel (formed September 2025), which together with The Gentlemen and Akira accounted for 49.5% of all global ransomware attacks in Q2 2026 per ZeroFox. 163 victims in Q1 2026 (+106% vs Q4 2025, rank #4 globally); estimated 179 victims in May 2026 alone (36% of all May DLS posts per Cybersecurity Dive); 311 confirmed victims YTD as of June 20, 2026 (+87% month-on-month May→June); 335 YTD as of Aug 17, 2026 (~24 new victims in the 8 weeks following (14 in the most recent 30 days per ransomware.live). Notable geographic shift: US share fell from historically 50%+ to 21.2% of Q1 2026 victims, with Italy, Brazil, and Turkey absorbing the balance — deliberate targeting diversification to reduce law-enforcement exposure. July–August 2026 activity: at least 5 new postings in July's first two weeks (ComTRI GmbH/Germany/IT, Gies Dienstleistungen/Germany/facilities, A. Bianchini/Spain/manufacturing, Hotel de la Bourse/France/hospitality, JS Hotels/Spain/hospitality — all 🟥 unverified); last observed activity Aug 20, 2026. Top targeted sectors: Manufacturing (18%), Professional Services (17%), Technology (13%), spanning 68 countries as of Aug 2026. September-October 2026 activity continued across Latin America, Asia and Oceania: Contreras Hermanos S.A. (Argentina, infrastructure, claimed Sep 8); Forus S.A. (Chile, apparel, claimed Sep 18); Camorim Serviços Marítimos (Brazil, maritime services, listed Sep 29); SKY CC Company Limited (Thailand, business services, listed Oct 14); Karix (US, mobile communications, claimed Oct 15); Ultimate Health Plans (Florida Medicare Advantage provider, claimed Oct 19); Poole Group (Australian accounting/advisory firm, DLS listing Oct 12, company separately confirmed "a cyber incident" Oct 16 without attributing it to LockBit — see the ongoing case on this site, publication deadline Oct 25). All DLS-claim confidence only except Poole Group's company-confirmed incident. Volume tracking is noisy and trackers disagree sharply this window: one secondary citation puts claimed total victims at 384 as of Oct 19 (20 in the trailing 30 days), while SOCRadar's own Oct count puts the trailing-60-day figure at 44, concentrated in professional services and healthcare — neither figure is independently verified here, so the ytd/l3m fields above are left at the last directly-sourced ransomware.live snapshot (Aug 17) rather than updated to either secondhand number.
Tradecraft¶
- Cross-platform 5.0 ("ChuongDong"): Windows, Linux and ESXi variants (4 build types released Jan 14, 2026:
LB_Black,LB_Linux,LB_ESXi,LB_ChuongDong); randomized 16-character extensions; Russian-language system avoidance. - Windows binary: heavy obfuscation/packing, DLL reflection, ETW patching (
EtwEventWritepatched in-memory to blind EDR telemetry), security-service termination; payloads reflection-loaded from memory (no disk artifact). - Social engineering: impersonating IT/help-desk via Microsoft Teams to push remote-access tools (Quick Assist).
- ~80% Windows targets, ~20% ESXi/Linux; double-extortion model with dedicated Tor leak portal.
- Refreshed affiliate incentive model to re-recruit operators post-Operation Cronos disruption.
- Encryption scheme confirmed as XChaCha20 + Curve25519 across all three build families, sharing core execution logic and identical ransom-note content; Windows build is custom-packed, Linux/ESXi builds ship unpacked (Acronis Threat Research Unit).
- Shadow-copy deletion via a quiet COM-based technique reportedly derived from leaked Conti source code, plus anti-debugging and geo-checking, on top of the ETW-patching blinding already noted (Halcyon).
- Terminates a hardcoded list of 63 service names before encryption begins (LevelBlue SpiderLabs).
No qualifying 2026 law-enforcement action (arrest, indictment, infrastructure seizure) found as of this update — the Feb 2024 Operation Cronos takedown and the 2024 US indictments/sanctions remain the most recent.
Notable recent victims¶
- Central Romana Corporation (Dominican Republic, agribusiness)
- Shougang Hierro Perú (mining)
- DaikyoNishikawa (Japan, automotive parts); Sierra Vista Hospital (US healthcare)
- Clarinda Regional Health Center (Iowa, USA — healthcare; attack Oct 2025, 24,341 patient records including SSNs; breach notification letters mailed June 2026)
- ComTRI GmbH (Germany, IT services, July 2026 🟥); Gies Dienstleistungen GmbH (Germany, facilities, July 2026 🟥); JS Hotels (Spain, 10-property hospitality group, July 2026 🟥)
- Contreras Hermanos S.A. (Argentina, infrastructure, Sep 8 🟥); Forus S.A. (Chile, apparel, Sep 18 🟥); Camorim Serviços Marítimos (Brazil, maritime, Sep 29 🟥); SKY CC Company Limited (Thailand, business services, Oct 14 🟥); Karix (US, mobile communications, Oct 15 🟥); Ultimate Health Plans (US, Florida Medicare Advantage, Oct 19 🟥); Poole Group (Australia, accounting/advisory — company-confirmed incident, attribution unconfirmed, Oct 16 🟨)
Assessment¶
A resilient brand that survived a global law-enforcement takedown and rebuilt at scale via its affiliate network. The ESXi focus, ETW blinding, and Teams-based help-desk social engineering are the headline risks. The Qilin/DragonForce/LockBit cartel is operationally confirmed as of Q2 2026 and accounts for ~30% of all global ransomware DLS postings on its own; the DOJ's July 16, 2026 bulletproof-hosting indictment targeting Media Land (used by LockBit, Cl0p, and Play) is the first direct counter-cartel infrastructure action naming LockBit-adjacent operations since Operation Cronos. The deliberate US targeting reduction in Q1 2026 remains operationally notable — spreading geographic risk in response to the February 2024 Operation Cronos and subsequent US/UK/Australian sanctions on named affiliates. As of August 2026, LockBit is posting at a slower pace (~14 new victims in the last 30 days vs. an estimated 179 in May 2026 alone), consistent with affiliate-base attrition following the BPH indictment. Available evidence does not establish that the original pre-Cronos central organization has recovered its former operational tempo; the brand persists primarily as an affiliate franchise. September-October 2026 claims show continued geographic spread (Argentina, Chile, Brazil, Thailand, US, Australia) rather than concentration in any one region or sector, consistent with the deliberate diversification noted since Q1 2026. No new law-enforcement action against the brand surfaced this update, and no named 2026 CrowdStrike/Mandiant/ESET/Trend Micro report with LockBit-5.0-specific findings was located beyond the vendor sources already cited below — a gap worth closing at the next refresh. Watch for any renewed affiliate-recruitment push, infrastructure rebuild event, or a reconciled victim-count figure from a primary tracker (current secondary citations disagree by roughly an order of magnitude on trailing-30/60-day pace).
Sources¶
- Trend Micro — New LockBit 5.0 Targets Windows, Linux, ESXi
- Check Point — LockBit 5.0: Ransomware Gang Returns in Force
- Picus — The LockBit Comeback After a Global Takedown
- Check Point Research — State of Ransomware Q1 2026
- Industrial Cyber — Ransomware sector reconsolidating Q1 2026
- Check Point Research — June 2026 Ransomware Report (LockBit rank, 7% global share)
- ZeroFox — Q2 2026 Ransomware Wrap-Up (five-group cartel, 49.5%)
- GBHackers — LockBit 5.0 Affiliate Panel and Build Variants Exposed (Jan 2026)
- TechTimes — DOJ Charges Russians Who Ran Hosting Infrastructure for LockBit, Cl0p, Play (Jul 16, 2026)
- HIPAA Journal — Clarinda Regional Health Center (LockBit5 Oct 2025 attack, 24,341 patients)
- DeXpose — LockBit Ransomware Threat Intelligence Guide (2026)
- CybelAngel — LockBit Ransomware: Attack Methods and 2026 Status
- Ransomware.live — LockBit 5.0 group stats (as of Aug 17, 2026)
- Arete — LockBit 5.0: The RaaS That Refuses to Go Away
- Acronis TRU — LockBit Strikes with New 5.0 Version Targeting Windows, Linux and ESXi Systems
- Halcyon — LockBit (5.0) threat-group profile
- LevelBlue SpiderLabs — 19 Shades of LockBit 5.0, Part 3
- DeXpose — LockBit 5.0 Compromises Karix
- DeXpose — LockBit 5.0 Targets Ultimate Health Plans
- SOCRadar — SKY CC Company Limited LockBit5 listing
- SOCRadar — Camorim Serviços Marítimos LockBit5 listing
- DeXpose — LockBit 5.0 Strikes Chilean Apparel Leader Forus S.A.
- DeXpose — LockBit 5.0 Strikes Argentinian Infrastructure Firm Contreras Hermanos S.A.
- Cyber Daily — Exclusive: Poole Group investigating LockBit ransomware attack
⏳ Ongoing cases¶
Follow-through on this desk: of 1 clock(s) run out — 1 outcome unknown. All cases →
- Oct 12Claimed by actor 🟥 LockBit DLS listing, unverified, no company confirmation independently corroborated. Breachsense
- Oct 12Clock set → expires Oct 25 🟥 ~2-week publication clock per the DLS listing. Breachsense
- Oct 16Victim confirmed 🟨 Company confirms a cyber incident affecting part of its IT environment and says it notified OAIC, ACSC and the ATO; does not confirm LockBit's specific attribution or what data was taken, and has not yet determined if individuals were affected. Cyber Daily
🗂️ Attacks & victims¶
All disclosed victims attributed to this actor, newest first.
October 2026
July 2026
June 2026