CampaignPublished 21 Jan 2026

Detailed Analysis of LockBit 5.0

Source AlienVault OTX General

Description

LockBit, originating as ABCD ransomware in 2019, has evolved to version 5.0 in September 2025. After a period of inactivity, it resumed operations in December 2025 with a reduced affiliate sign-up fee. LockBit 5.0, nicknamed ChoungDong, consists of a Loader and Ransomware component. The Loader decrypts and executes the payload in memory, while the Ransomware uses ChaCha20 and Curve25519 for encryption. This update significantly enhances evasion techniques and attack efficiency, introducing features like Mutex, Execution Delay, and Wiper. The group's history includes affiliation with the Maze cartel, independent operations, and continuous upgrades. Mitigation strategies involve monitoring process behavior, applying security patches, and preparing for swift responses using provided IoCs and MITRE ATT&CK techniques.

Impact

For European organizations, LockBit 5.0 poses a significant threat due to its advanced evasion capabilities and destructive potential. The use of strong encryption algorithms means that encrypted data is effectively inaccessible without paying ransom or having reliable backups. The introduction of a wiper component increases the risk of permanent data loss, which can severely disrupt business operations, especially in critical sectors such as healthcare, finance, manufacturing, and government. The affiliate model and reduced sign-up fees may lead to increased attack frequency and diversity, targeting a wider range of organizations across Europe. The ransomware’s ability to execute payloads in memory complicates detection and response efforts, potentially allowing longer dwell times and more extensive damage. Double-extortion tactics, where data is exfiltrated before encryption, threaten confidentiality and increase regulatory and reputational risks under GDPR and other data protection laws. The medium severity rating reflects the balance between the threat’s capabilities and the current lack of widespread exploitation, but the potential impact on confidentiality, integrity, and availability remains high.

Defensive guidance

European organizations should implement advanced endpoint detection and response (EDR) solutions capable of detecting in-memory execution and process injection techniques. Monitoring for unusual mutex creation and execution delays can help identify LockBit 5.0 activity. Network segmentation and strict access controls should be enforced to limit lateral movement. Regular patching of operating systems and applications is critical to reduce attack surface, even though no specific CVEs are currently exploited. Organizations should maintain and regularly test offline backups to ensure data recovery without paying ransom. Incident response plans must be updated to incorporate LockBit-specific IoCs and MITRE ATT&CK techniques such as T1055.012 (process injection) and T1070.006 (indicator removal). Threat intelligence sharing within industry sectors and with national cybersecurity centers can improve detection and response. User training should emphasize phishing awareness, as initial infection vectors often involve social engineering. Finally, organizations should consider deploying deception technologies to detect ransomware activity early and disrupt execution.

Indicators of compromise

Hashes 8

5e1f61b9c1c27cad3b7a81c804ac7b86
d57a61761cc5a210207a42eaa223f40d
f79ea684b3d459cf3f9d93dac0818ad5
c1888ba296f57e87a84411ddfce3cabc4536b142
f91a868859f4136dcf0c4cb1fad68fa0e410c41e
180e93a091f8ab584a827da92c560c78f468c45f2539f73ab2deb308fb837b38
5fc709c53f1a714c2fe13130458880f90ad02cd72913e90517aa54d32109acc6
6abb008fdeede9cddb8ea05c382a89ef654d4d8a88f490719d473d4bfd0705b7

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 21 Jan 2026, 23:20 UTC

MITRE ATT&CK techniques2 from threat tags

Technical details

Indicators of compromise

Hashes 8

Community reviews

Related threats