✅ Report Title: Inside the Ecosystem & Operations: LockBit 5.0 Ransomware Group

✅ Executive Summary:

📌 Who Is the LockBit 5.0 Ransomware Group?

• LockBit began operating independently under the name ABCD ransomware in September 2019, and from the end of December 2019, it established the current LockBit brand by using the .lockbit extension.
• In September 2020, the group established its own Data Leak Site (DLS) to implement a double-extortion strategy involving data exfiltration. Following four major updates, LockBit 5.0 was released in September 2025. Through this, LockBit has established itself as one of the most enduring RaaS (Ransomware-as-a-Service) groups to date.

📌 Victims

• A total of 3,608 cases were identified, peaking at 1,140 cases in 2023. In 2025, active attack operations declined to 137 recorded cases as preparations shifted toward LockBit 5.0.
  • A total of 9 LockBit-victim companies classified as 'South Korea' have been confirmed. By year, there were 2 cases each in 2021 and 2022, and 4 cases in 2023, with the highest number of records concentrated in 2023. There were no public cases after 2024, and one case was confirmed in 2025. As of July 2026, no additional disclosure cases have been confirmed. The records of South Korean damage also show a similar trend to the global activity pattern, with the highest occurrence in 2023 when LockBit's worldwide activities peaked.

📌 Group Profiling

• Following the release of LockBit 5.0, operations resumed across Deep and Dark Web (DDW) forums such as RAMP and Rehub to promote the Ransomware-as-a-Service (RaaS) model and recruit affiliates.
  • After the LockBit Affiliate panel hacking incident, they returned to the RAMP forum in September 2025 and engaged in activities such as distributing free panel access rights to affiliates of competing groups to check other RaaS groups and recover their reputation.
  • Promotional activities for RaaS remained limited on Rehub, indicating that LockBit transitioned to self-hosted infrastructure starting with version 5.0 to reduce reliance on external forums.

📌 Affiliate Infiltration Findings

• Identified the features and capabilities provided by the LockBit 5.0 administration panel.
  • According to internal regulations of LockBit, there are no specific prohibited industries for attacks, and CIS countries are confirmed as prohibited targets.

📌 Binary Analysis

• LockBit 5.0 provides four distinct ransomware builds targeting Windows, Linux, and VMware ESXi environments, focusing on cross-platform attacks and large-scale encryption.
  • LockBit Black: Modified the XOR key value used for API resolving from the previous LockBit Black ransomware variant.
  • LockBit ChuongDong: Added encryption ratio setting and large file split encryption function.
  • LockBit Linux/ESXi: Supports analysis evasion, partial encryption, self-deletion, and free space overwriting functions.

✅ Threat Detection Recommendations and Mitigation Measures:

• LockBit 5.0 has been reorganized into a RaaS operating system that integrates its own infrastructure, from affiliate recruitment to build creation and negotiation, providing attack capabilities for Windows, Linux, and ESXi.
• Therefore, it is necessary to monitor not only external forums but also DLS and affiliate infrastructure together, and to strengthen internal spread prevention and protection of core virtualization assets.