Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

1. Background & Context

LockBit 5.0 resurfaces with advanced Windows, Linux, and ESXi variants, boasting heavy obfuscation and anti-forensic techniques, making it more dangerous than ever.

LockBit 5.0 resurfaces with advanced Windows, Linux, and ESXi variants, boasting heavy obfuscation and anti-forensic techniques, making it more dangerous than its predecessors.

In 2019, on Russian underground forums, a piece of malware appeared without glamour, baptized simply as “ABCD” after the extension it left…

So, I was scrolling through Hacker News and saw a headline for LockBit 5.0. I honestly couldn’t believe my eyes. Are they really still…

Cisco Talos confirms Storm-2603 is abusing the DFIR tool Velociraptor for persistence and arbitrary code execution, deploying LockBit and Babuk ransomware against VMware and Windows servers.

Cisco Talos confirms Storm-2603 is abusing an outdated Velociraptor build (CVE-2025-6264) for persistence and arbitrary code execution, deploying LockBit and Babuk ransomware.

After Operation Cronos, LockBit resurfaced with the cross-platform 5.0 ("ChuongDong") ransomware, which uses advanced anti-analysis and hits Windows, Linux, and ESXi servers.

The ransomware market fragmented into 85 active groups in Q3 2025. LockBit 5.0 resurfaced, but Check Point notes the landscape is now highly fluid and less predictable.

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

Despite takedown, LockBit 5.0 resurges as a cross-platform threat. The new variant blinds Windows Event Tracing (ETW), uses Invisible Mode for stealth encryption, and overwrites free disk space.

New 01flip ransomware (written in Rust) targets APAC critical infra across Windows/Linux. The attackers use Sliver for C2 and older exploits for access. A curious "lockbit" ignore list was found in the code.

GOLD SALEM (Storm-2603) is exploiting SharePoint via ToolShell then abusing the Velociraptor DFIR tool as a ransomware precursor. The group deploys Warlock and LockBit 3.0 variants, often targeting critical infra.

The U.S. Treasury is cautiously suggesting that the ransomware market may be beginning to cool. In a new

In a digital underworld increasingly fractured by law enforcement takedowns and eroding trust, three of the most notorious ransomware groups have allegedly joined forces. A new report by the Yarix…

The hydra of the cybercrime world has grown another head. Since its emergence in late 2019, the LockBit gang has arguably become the most prolific ransomware operator in history. Now, a new analys…

A comprehensive new analysis by security researchers at S2W details the inner workings of the DragonForce Ransomware Group, revealing a threat actor that is not only deploying sophisticated malwar…

LockBit 5.0 launches with a unified codebase targeting Windows, Linux, and ESXi. Acronis reveals identical encryption and ties to SmokeLoader.

The DFIR Report reveals how a persistent attacker exploited CVE-2023-46604 twice in 18 days to deploy LockBit ransomware. Patch your ActiveMQ servers now!