After several months of silence following the blow dealt by Operation Cronos in early 2024, LockBit—one of the most active and dangerous ransomware groups in the world—is back in the game. And it's not making a quiet return.
Despite authorities managing to dismantle part of its infrastructure and slow its activity, the group led by the notorious LockBitSupp has managed to reorganize, rebuild its operation from scratch, and launch a new and more advanced version: LockBit 5.0, also known internally as "ChuongDong."
This new variant marks a significant step forward in the evolution of ransomware. With more sophisticated techniques and the ability to target multiple platforms, LockBit 5.0 is aimed squarely at organizations running Windows, Linux, and ESXi systems.
In September 2025, LockBit proved its comeback was more than just talk. In just a few weeks, the new campaign managed to compromise a dozen organizations across Western Europe, the Americas, and Asia.
Half of these attacks were carried out using the newly released LockBit 5.0 variant, while the rest used LockBit Black, a still-active earlier version.
Most concerning: nearly 80% of the attacks affected Windows systems, which is no surprise given their widespread use in corporate environments. The other 20% targeted ESXi and Linux systems, demonstrating LockBit’s continued technical expansion and flexibility to adapt to diverse environments.
According to researchers at Check Point, this wave of attacks is a clear sign that LockBit’s Ransomware-as-a-Service (RaaS) model is still very much alive. In fact, what we’re seeing is a successful reorganization of its affiliate network.
In early September, LockBitSupp reappeared on underground forums announcing their return—this time with new rules: to join the program and gain access to the control panel and encryption tools, new affiliates must pay a $500 deposit in Bitcoin.
This move not only filters for serious candidates but also helps fund the group’s infrastructure. And it’s working: within weeks, the ransomware was operating with renewed strength and effectiveness.
LockBit 5.0 Affiliate Registration Screen (Source: Check Point)
LockBit 5.0 isn’t just a flashy new version—it comes packed with technical upgrades that make it more dangerous, efficient, and harder to detect than ever before.
One of the most significant updates is its cross-platform compatibility. It now includes versions specifically designed to target Windows systems, Linux, and ESXi servers, allowing it to easily adapt to various types of enterprise infrastructures.
A major improvement is the optimization of its encryption routines. LockBit 5.0 can encrypt files at a much faster rate than its previous versions, which means security teams have less time to detect and stop the attack before serious damage is done. This express encryption renders many traditional security solutions unable to respond in time.
LockBit 5.0 has also enhanced its ability to evade detection mechanisms, especially those based on signatures. It now uses random 16-character file extensions, making it harder for antivirus software and forensic tools to recognize clear patterns.
Additionally, it includes more advanced anti-analysis features that block reverse engineering attempts and make it significantly harder for researchers to dissect the malware. In short, understanding how LockBit 5.0 works is now much more complex, delaying defenses and extending its window of activity.
Each LockBit 5.0 attack leaves behind an updated ransom note clearly identifying the variant name. These notes include personalized links for negotiating with the attackers and a strict deadline: 30 days to pay, or the stolen data will be published.
This kind of pressure isn’t just about extracting money quickly—it also corners organizations from the outset, exploiting fears of reputational damage and legal penalties from data breaches.
Read more: Ransomware 2025: Threats, Costs, and How to Defend Your Business
With LockBit 5.0 actively attacking and demonstrating increasingly sophisticated capabilities, strengthening cybersecurity is no longer optional—it’s an urgent necessity. For many organizations, especially those without large IT teams, having a clear defense plan can mean the difference between a minor disruption and a full-blown operational disaster.
Here are some key actions every company should consider:
Beyond best practices, partnering with reliable tech providers can significantly raise protection levels. For example, at TecnetOne, we offer an ecosystem of solutions designed to proactively tackle threats like LockBit 5.0:
These solutions are not only designed to prevent attacks but also to ensure operational continuity and fast recovery—two critical elements in the face of modern ransomware.
The return of LockBit 5.0 is a clear signal that ransomware groups don’t disappear easily. Even when law enforcement disrupts their operations, many of these groups have the ability to reorganize, learn from their mistakes, and come back stronger.
The key for organizations is to stay vigilant. Being prepared, investing in cybersecurity, and training personnel is more crucial than ever. And with the backing of experts like those at TecnetOne, the chances of withstanding and recovering from an attack increase significantly.