LockBit strikes with new 5.0 version, targeting Windows, Linux and ESXI systems

Acronis TRU analyzed LockBit 5.0, a multi-platform ransomware family (Windows, Linux, ESXi) that uses XChaCha20 and Curve25519 for encryption, employs advanced defense-evasion and anti-analysis techniques (packing, DLL unhooking, process hollowing, ETW patching), conducts double-extortion via data exfiltration and maintains a public leak site with active victim listings; Linux/ESXi variants target virtualization including Proxmox/VMFS and include free-space wiping, and the report includes IoCs and links to suspected infrastructure reuse with SmokeLoader.