lockbit5
Intelligence Profile
LockBit 5.0 ("ChuongDong") emerged in September 2025 as the group's resurgence following the February 2024 law enforcement takedown, introducing cross-platform payloads targeting Windows, Linux, and VMware ESXi with enhanced evasion capabilities and continuing the RaaS affiliate model of its predecessors.
Threat Analysis
lockbit5 is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of financial.
Financially motivated threat actors like lockbit5 prioritize monetary gain through methods such as ransomware deployment, banking trojans, cryptocurrency theft, BEC scams, or credential harvesting for resale on underground markets.
Known Campaigns
Lockbit5 is conducting an active ransomware campaign targeting organizations across 10 countries. Primary targets: Agriculture and Food Production, Construction, Consumer Services. 118 confirmed victims recorded in the last 45 days. Campaign status: ACTIVE (last activity 6 Apr 2026).