LockBit 5.0 Actively Attacking Windows, Linux, and ESXi Environments

The report describes LockBit's return in September 2025 with the release of LockBit 5.0 (“ChuongDong”) and active campaigns that compromised roughly a dozen organizations across multiple regions. LockBit 5.0 adds multi-platform builds (Windows, Linux, ESXi), faster system-wide encryption, randomized file extensions, and stronger anti-analysis capabilities while the group rebuilt its RaaS affiliate model to recruit new actors.