Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

1. Background & Context

LockBit 5.0 resurfaces with advanced Windows, Linux, and ESXi variants, boasting heavy obfuscation and anti-forensic techniques, making it more dangerous than ever.

LockBit 5.0 resurfaces with advanced Windows, Linux, and ESXi variants, boasting heavy obfuscation and anti-forensic techniques, making it more dangerous than its predecessors.

In 2019, on Russian underground forums, a piece of malware appeared without glamour, baptized simply as “ABCD” after the extension it left…

So, I was scrolling through Hacker News and saw a headline for LockBit 5.0. I honestly couldn’t believe my eyes. Are they really still…

Cisco Talos confirms Storm-2603 is abusing the DFIR tool Velociraptor for persistence and arbitrary code execution, deploying LockBit and Babuk ransomware against VMware and Windows servers.

Cisco Talos confirms Storm-2603 is abusing an outdated Velociraptor build (CVE-2025-6264) for persistence and arbitrary code execution, deploying LockBit and Babuk ransomware.

After Operation Cronos, LockBit resurfaced with the cross-platform 5.0 ("ChuongDong") ransomware, which uses advanced anti-analysis and hits Windows, Linux, and ESXi servers.

The ransomware market fragmented into 85 active groups in Q3 2025. LockBit 5.0 resurfaced, but Check Point notes the landscape is now highly fluid and less predictable.