New LockBit 5.0 Targets Windows, Linux, ESXi

Trend Research details LockBit 5.0 as an active, cross-platform ransomware family (Windows, Linux, ESXi) that uses heavy packing/obfuscation, in-memory DLL reflection loading, ETW patching, service termination, event log clearing, randomized 16-character file extensions, and geopolitical safeguards; the ESXi variant can encrypt entire virtual infrastructures, amplifying impact. The report provides command-line parameter mappings, IOCs, hunting queries, and code-comparison evidence linking 5.0 to LockBit 4.0, and recommends enhanced cross-platform and virtualization protections.