LockBit 5.0: The Ransomware Resurgence Nobody Saw Coming

Executive Summary: Operation Cronos Failed to Kill It

Operation Cronos was supposed to end LockBit. In February 2024, the FBI, UK's NCA, Europol, and agencies from eight other countries took down the group's infrastructure, seized its source code, arrested its ringleader Dmitry Khoroshev's alleged operator, and distributed decryption keys to victims.

Check Point described it as a "significant blow."

It didn't matter. By September 2025 — 19 months later — LockBit was back online, hitting at least twelve organizations with a brand-new variant called LockBit 5.0 (codenamed "ChuongDong"), released on the group's sixth anniversary.

That's the headline. But what happened in between is more instructive for defenders: how the group restructured after being dismantled, why affiliates came back, and why the encryption algorithm now matches modern cryptosystems used in legitimate TLS 1.3 rather than legacy RSA/AES stacks.

If you run servers — even behind a home router — LockBit's return isn't theoretical anymore. Here's what we know, sourced from Check Point Research (Oct 2025), Trend Micro (March 2024 – Oct 2025), Proven Data, LevelBlue SpiderLabs, AHA-ISAC, and related advisories.

How LockBit Survived the Biggest Takedown in Ransomware History

The Post-Cronos silence

Leaked from Operation Cronos showed that LockBitSupp (the pseudonym for the group's administrator) had been banned from Exploit.in and XSS.is before the takedown — severely limiting their ability to communicate with affiliates after the infrastructure went dark. The data leak site went offline. The admin panel was seized. Most observers expected a long winter for the group.

That's exactly what happened. LockBitSupp posted one defiant message on the RAMP forum in May 2025: "We always rise up after being hacked." No follow-up until August. The gap between operational collapse and public announcement is a feature, not a bug — it gives the operator time to rebuild infrastructure under new identities without attracting analyst attention. During this silence period, researchers analyzed LockBit's Data Leak Site history and found no new victim postings after May 2025. This contradicts earlier claims of a faster resurfacing timeline, suggesting the group spent months quietly rebuilding rather than waiting for public attention.

When LockBitSupp finally posted again in August 2025 — "getting back to work" — and attempted (unsuccessfully) to reclaim XSS forum status via community vote, the groundwork was already laid. The official September announcement wasn't a surprise; it was a controlled rollout with prepared infrastructure.

Rebuilding from scratch — or near enough

LockBit didn't rebuild. They evolved. Key continuity mechanisms:

1. Brand equity. LockBit spent years building trust with affiliates through reliable payment processing (affiliates received 80% of ransoms). That reputation survived the leak.
2. Affiliate network durability. When RansomHub folded in April 2025, its displaced affiliates migrated to Qilin and DragonForce before LockBit's official announcement — forming a pipeline that formalized into a cartel alliance within weeks.
3. Operational knowledge survives infrastructure seizures. Even with source code stolen, the core ransomware architecture was preserved in affiliate-builder tooling already distributed across the network.

The LockBit – Qilin – DragonForce Alliance Explained

In early September 2025, DragonForce publicly proposed a cartel-style coalition on dark web forums. LockBit confirmed within hours. The stated purpose: "equal competition conditions, no conflicts" between members while aiming to "dictate market conditions."

What the alliance actually involves (per analyst reporting)

Why this matters for small defenders: It means a single campaign can now include malware built on tools from three different crews, each with their own TTP fingerprint. Your detection signatures need to account for multi-brand tool reuse — not just LockBit's specific IOCs.

The alliance's operational reality vs PR posture

Fortinet's FortiGuard notes that the claim has not been independently verified for all claimed elements. The cartel is best understood as a loose affiliation rather than a corporate merger: no documented hierarchy, no revenue-sharing agreement, no joint command-and-control. Think of it more like two competing franchises sharing a wholesale supply chain.

Technical Indicators: What LockBit 5.0 Actually Does

This section covers confirmed IOCs (from AHA-ISAC and vendor advisories) and suspected behaviors flagged in reverse-engineering reports.

Cryptography — the big change

LockBit 5.0 uses XChaCha20 + Curve25519 for encryption. This is a meaningful upgrade: prior versions used AES/RSA combinations that could be broken with leaked private keys after takedowns (the basis of the NCA decryption tool). XChaCha20 is the stream cipher of choice in modern TLS 1.3; it has no known weakness, and there are no "master key" shortcuts because the symmetric encryption is performed locally on the victim's machine before the public key exchange happens.

The file extension is now a random 16-character hex string per victim (e.g., .db9785905a3cad2c) — not the old .lockbit suffix.

Defense evasion techniques (confirmed)

Platform coverage

LockBit 5.0 ships as Windows, Linux, and ESXi variants using the same XChaCha20/Curve25519 encryption pipeline across all three platforms — meaning a single affiliate campaign can hit your Windows workstation AND your ESXi host AND the Linux server in one sweep.

This matters for homelab admins running virtualization. A compromised Windows VM is no longer isolated from the hypervisor.

Behavior you should monitor for

Encrypted file pattern: .*\.random_hex16      # Regex: \.[a-f0-9]{16}$
Ransom note filename:  ReadMeForDecrypt.txt    # Confirmed across all variants
Loader process name:   defrag.exe (hollowed)   # Legitimate Windows binary abused

YARA rule for LockBit 5.0 family indicators

rule LockBit_5_Generic {
    meta:
        description = "Generic indicator for LockBit ransomware variants including v5"
        author      = "Malwlab Ghost / synthesized from public IOCs"
        date        = "2026-07-11"
        score       = 80
    strings:
        $s1   = "This file is encrypted!" ascii wide
        $s2   = "Decryptor.exe"           ascii wide
        $s3   = "ransom"                  ascii wide
        $anti1 = "IsDebuggerPresent"     ascii wide
        $net1  = "/submit.php"            ascii wide
        $mutex1 = "Global\\LockBitMutex_"  ascii wide
    condition:
        pe_header and (
            (3 of ($s1, $s2, $s3)) or
            (2 of ($anti1, $net1, $mutex1))
        )
}

The YARA rule above is synthesized from confirmed LockBit family strings identified by LevelBlue SpiderLabs and Proven Data. It captures patterns common to the entire LockBit lineage — including v5's variants — rather than a single hash. For production environments, pair this with vendor-provided Sigma rules for ReadMeForDecrypt.txt detection (confirmed file event signature) and Sysmon Event 1 hunting on unexpected children of defrag.exe spawned from non-standard parents.

YARA/Sigma rule notes

What To Do If You Get Hit

If your environment shows signs of LockBit encryption — files with random hex extensions appearing, defrag.exe spawning unexpected children, or the characteristic ransom note landing on desks — do not pay. Here's what to do instead:

1. Isolate immediately. Disconnect infected machines from the network before the encryption completes. A running lockbit5 process that hasn't finished may still allow decryption of already-encrypted files if caught in time.
2. Preserve forensic artifacts. Memory dumps, disk images, and log captures go before any cleanup. LockBit patches ETW (Event Tracing for Windows) before encrypting — your logs will be incomplete unless you captured events prior to infection.
3. Check for decryption tools. Check Point and the NCA have historically provided decryption utilities for LockBit variants that used RSA-1024 (v3/v4). These do not work against XChaCha20. If you're hit with a v5 variant, there is no magic decrypt key.
4. Check backup integrity. Test restore from your offline/immutable backups before deciding on a recovery path. This step takes longer than it should but saves hours of guesswork when encryption has already begun.

Actionable Hardening for Small Environments

You don't need an EDR platform the size of your city's annual budget to defend against LockBit 5.0. The techniques described above are effective at evading signature-based detection, but behavioral monitoring still catches them.

Priority 1: What to do tomorrow

• Patch ESXi — ensure your hypervisor hosts are updated. LockBit 5.0's cross-platform support means an attacker who lands on a Windows workstation can pivot to the hypervisor. Homelab admins running ESXi/Proxmox should treat this as critical.
• Isolate backups — enable versioning where possible (Veeam, BorgBackup) and keep immutable copies offline or air-gapped. A 63-service kill table means your local backup services will be terminated before encryption begins. Immutable/offline backups are the only reliable mitigation against volume encryption.
• Enable ETW logging — if LockBit patches EtwEventWrite to blind telemetry, also log ETW activity itself (kernel-level hooks on the ETW API) so you can detect when someone is trying to silence it.

Priority 2: Detection tuning this week

Priority 3: Architecture changes this month

• Network segmentation between hypervisor hosts and management networks. If an attacker hits a workstation in the guest OS, they shouldn't reach the host ESXi API or the IPMI interface.
• Run backup jobs from a separate VLAN with no inbound connections from general-purpose network segments. This defeats lateral movement by design.
• Hunt for SmokeLoader infrastructure patterns. Proven Data notes historical association between LockBit DLS infrastructure and SmokeLoader loaders. If your environment is in scope for threat hunting, correlate DNS logs with known SmokeLoader-associated domains/resolvers.

Why Homelab Admins Should Pay Attention

The narrative around ransomware tends to focus on hospitals, pipelines, and multi-national corporations. LockBit 5.0 doesn't care which tier you're in — its affiliate program explicitly permits attacks against critical infrastructure (including medical facilities), placing legal responsibility on affiliates rather than operators. The $500 BTC deposit required for access is trivial by any measure; the barrier to entry has dropped, not risen.

An attacker using LockBit 5.0 tools doesn't need sophisticated exploits — they need an SMB share, a weak VPN credential, or a vulnerable proxy (a category of vulnerability that has historically been common in homelab setups with exposed Proxmox/ESXi interfaces). The encryption is now too strong for decryption keys to help after the fact; XChaCha20 doesn't have the "master key" weakness that made AES/RSA variants breakable post-takedown.

Your best defense is layered: backups you can trust (immutable/offline), detection rules tuned for the specific indicators above, and network segmentation that limits lateral movement between guest OS and hypervisor. None of this requires enterprise budget — it requires discipline.

Sources Used