LockBit ransomware secretly building next-gen encryptor before takedown

Trend Micro analyzed a leaked development sample of LockBit-NG-Dev (likely LockBit 4.0), a .NET-based cross-platform encryptor compiled with CoreRT and packed with MPRESS; the sample includes a JSON configuration, supports AES+RSA encryption modes (fast, intermittent, full), custom exclusions, randomized filenames, and a self-delete mechanism, though it lacks some propagation and printer ransom-note features seen in prior versions, and law enforcement disruption (Operation Cronos) has impeded the group's infrastructure.