Authorities dismantled LockBit before it could unleash revamped variant

Trend Micro analyzed an in-development LockBit variant called 'LockBit-NG-Dev' that would be cross-platform via .NET/CoreRT, packed with MPRESS, and include anti-analysis expiry checks and multiple encryption modes; although functional but incomplete and disrupted by recent arrests, the variant and leaked code pose continued ransomware risk because many affiliates remain and the code could be reused by other gangs.