LockBit's new variant is 'most dangerous yet,' hitting Windows, Linux and VMware ESXi
(2025/09/26)
- Reference: 1758896888
- News link: https://www.theregister.co.uk/2025/09/26/lockbits_new_variant_is_most/
- Source link:
Trend Micro has sounded the alarm over the new LockBit 5.0 ransomware strain, which it warns is "significantly more dangerous" than past versions due to its newfound ability to simultaneously target Windows, Linux, and VMware ESXi environments.
In [1]a technical breakdown of source binaries obtained from recent attacks, Trend Micro researchers identified dramatically enhanced evasion, obfuscation, and cross-platform capabilities in the new iteration. "Heavy obfuscation and technical improvements across all variants make LockBit 5.0 significantly more dangerous than its predecessors," the researchers warned.
The Windows variant now loads payloads via DLL reflection and employs aggressive anti-analysis packing; the Linux variant accepts command-line directives to tailor which directories and file types to hit; and the ESXi version is built to seize virtualization infrastructure by encrypting VMs. What's more, each encrypted file is stamped with a random 16-character extension, a move designed to make restoring your data even more of a nightmare.
[2]
This is no incremental upgrade. Trend Micro warns that the combination of modular architecture, stealthy encryption routines and multi-OS targeting gives LockBit 5.0 the potential to paralyse entire enterprise stacks, from endpoints to hypervisor hosts.
[3]
[4]
"The existence of Windows, Linux, and ESXi variants confirms LockBit's continued cross-platform strategy. This enables simultaneous attacks across entire enterprise networks, from workstations to critical servers hosting databases and virtualization platforms," Trend Micro said.
LockBit's revival, as seen in version 5.0, follows a dramatic law enforcement takedown earlier this year. In February, [5]authorities in the UK and the US launched "Operation Cronos," seizing servers, domain infrastructure, and decryption keys in an effort to dismantle the group. Despite that action, the ransomware crew appears to be attempting a comeback, reactivating its affiliate program under a rebranded and seemingly hardened platform.
[6]
Researchers [7]note that LockBit's resurgence relies heavily on its affiliate network: affiliates execute attacks using the core framework, enabling operators to scale both reach and flexibility. In 5.0, the affiliate incentive model has [8]reportedly been refreshed, reflecting a strategy to re-recruit operators in the wake of disruption.
From a defender's perspective, the stakes could not be higher. Traditional prevention tools may struggle, especially since LockBit 5.0 can terminate security processes and delete backups. The ESXi targeting further threatens recovery by impairing virtual backups and making any fallback option more unreliable.
And from the crim's? Threat actors exploiting Windows, Linux and ESXi in one go could compress the time between breach and full encryption, leaving defenders little margin to detect and respond. Security teams now face a scenario where the threat surface spans virtualization infrastructure, operating systems and server applications in one campaign.
[9]Ding ding: Fortra rings the perfect-10 bell over latest GoAnywhere MFT bug
[10]Microsoft: SharePoint attacks now officially include ransomware infections
[11]Short circuit: Electronics supplier to tech giants suffers ransomware shutdown
[12]Asia dismantles 20,000 malicious domains in infostealer crackdown
"Despite Operation Cronos, the criminals behind the group exhibit resilience with all three variants of version 5.0 now confirmed," Trend Micro said. "Organizations must ensure comprehensive cross-platform defences are in place, with particular attention to protecting virtualization infrastructure. LockBit 5.0's Windows, Linux, and ESXi variants reinforce that no operating system or platform can be considered safe from modern ransomware campaigns."
It remains to be seen how widespread deployment of LockBit 5.0 will become, or whether the group can rebuild its reputation after its earlier disruption. But for now, enterprises and security teams must assume that ransomware is no longer confined to just Windows machines. The era of cross-OS, virtualization-aware ransomware is here. ®
Get our [13]Tech Resources
[1] https://www.trendmicro.com/en_gb/research/25/i/lockbit-5-targets-windows-linux-esxi.html
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aNa4iDXlKv9ZXuKUE_VdqQAAA4A&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aNa4iDXlKv9ZXuKUE_VdqQAAA4A&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aNa4iDXlKv9ZXuKUE_VdqQAAA4A&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://www.theregister.com/2024/02/20/lockbit_down_operation_cronos/
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aNa4iDXlKv9ZXuKUE_VdqQAAA4A&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://www.vectra.ai/blog/lockbit-is-back-whats-new-in-version-5-0?
[8] https://socradar.io/lockbit-5-0-ransomware-cartel-what-you-need-to-know/?utm_source=chatgpt.com
[9] https://www.theregister.com/2025/09/19/gortra_goanywhere_bug/
[10] https://www.theregister.com/2025/07/24/microsoft_sharepoint_ransomware/
[11] https://www.theregister.com/2025/08/22/data_io_ransomware_attack_temporarily/
[12] https://www.theregister.com/2025/06/11/asia_cracks_down_on_infostealers/
[13] https://whitepapers.theregister.com/
In [1]a technical breakdown of source binaries obtained from recent attacks, Trend Micro researchers identified dramatically enhanced evasion, obfuscation, and cross-platform capabilities in the new iteration. "Heavy obfuscation and technical improvements across all variants make LockBit 5.0 significantly more dangerous than its predecessors," the researchers warned.
The Windows variant now loads payloads via DLL reflection and employs aggressive anti-analysis packing; the Linux variant accepts command-line directives to tailor which directories and file types to hit; and the ESXi version is built to seize virtualization infrastructure by encrypting VMs. What's more, each encrypted file is stamped with a random 16-character extension, a move designed to make restoring your data even more of a nightmare.
[2]
This is no incremental upgrade. Trend Micro warns that the combination of modular architecture, stealthy encryption routines and multi-OS targeting gives LockBit 5.0 the potential to paralyse entire enterprise stacks, from endpoints to hypervisor hosts.
[3]
[4]
"The existence of Windows, Linux, and ESXi variants confirms LockBit's continued cross-platform strategy. This enables simultaneous attacks across entire enterprise networks, from workstations to critical servers hosting databases and virtualization platforms," Trend Micro said.
LockBit's revival, as seen in version 5.0, follows a dramatic law enforcement takedown earlier this year. In February, [5]authorities in the UK and the US launched "Operation Cronos," seizing servers, domain infrastructure, and decryption keys in an effort to dismantle the group. Despite that action, the ransomware crew appears to be attempting a comeback, reactivating its affiliate program under a rebranded and seemingly hardened platform.
[6]
Researchers [7]note that LockBit's resurgence relies heavily on its affiliate network: affiliates execute attacks using the core framework, enabling operators to scale both reach and flexibility. In 5.0, the affiliate incentive model has [8]reportedly been refreshed, reflecting a strategy to re-recruit operators in the wake of disruption.
From a defender's perspective, the stakes could not be higher. Traditional prevention tools may struggle, especially since LockBit 5.0 can terminate security processes and delete backups. The ESXi targeting further threatens recovery by impairing virtual backups and making any fallback option more unreliable.
And from the crim's? Threat actors exploiting Windows, Linux and ESXi in one go could compress the time between breach and full encryption, leaving defenders little margin to detect and respond. Security teams now face a scenario where the threat surface spans virtualization infrastructure, operating systems and server applications in one campaign.
[9]Ding ding: Fortra rings the perfect-10 bell over latest GoAnywhere MFT bug
[10]Microsoft: SharePoint attacks now officially include ransomware infections
[11]Short circuit: Electronics supplier to tech giants suffers ransomware shutdown
[12]Asia dismantles 20,000 malicious domains in infostealer crackdown
"Despite Operation Cronos, the criminals behind the group exhibit resilience with all three variants of version 5.0 now confirmed," Trend Micro said. "Organizations must ensure comprehensive cross-platform defences are in place, with particular attention to protecting virtualization infrastructure. LockBit 5.0's Windows, Linux, and ESXi variants reinforce that no operating system or platform can be considered safe from modern ransomware campaigns."
It remains to be seen how widespread deployment of LockBit 5.0 will become, or whether the group can rebuild its reputation after its earlier disruption. But for now, enterprises and security teams must assume that ransomware is no longer confined to just Windows machines. The era of cross-OS, virtualization-aware ransomware is here. ®
Get our [13]Tech Resources
[1] https://www.trendmicro.com/en_gb/research/25/i/lockbit-5-targets-windows-linux-esxi.html
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aNa4iDXlKv9ZXuKUE_VdqQAAA4A&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aNa4iDXlKv9ZXuKUE_VdqQAAA4A&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aNa4iDXlKv9ZXuKUE_VdqQAAA4A&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://www.theregister.com/2024/02/20/lockbit_down_operation_cronos/
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aNa4iDXlKv9ZXuKUE_VdqQAAA4A&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://www.vectra.ai/blog/lockbit-is-back-whats-new-in-version-5-0?
[8] https://socradar.io/lockbit-5-0-ransomware-cartel-what-you-need-to-know/?utm_source=chatgpt.com
[9] https://www.theregister.com/2025/09/19/gortra_goanywhere_bug/
[10] https://www.theregister.com/2025/07/24/microsoft_sharepoint_ransomware/
[11] https://www.theregister.com/2025/08/22/data_io_ransomware_attack_temporarily/
[12] https://www.theregister.com/2025/06/11/asia_cracks_down_on_infostealers/
[13] https://whitepapers.theregister.com/
Jou (Mxyzptlk)
But you know what happens to whistleblower in the normal world. Now take that into the criminal world. Which is why you hear from them all the time.
What is more expensive ?
alain williams
• Spending days negotiating with ransomware scum and maybe shelling out in bitcoin
• Implement (& test !) decent backups and be up & running again after a few days hard work restoring your systems
In either case your systems are down for a bit, it is a matter of how long it takes to get back.
Am I misunderstanding something ?
.
Threatening to put your data up on the dark web is a different threat.
It just goes to show that although taking down the infrastructure is temporarily it's not substitute for taking down the people responsible. The solution to that would be to offer rewards for information leading to the prosecution of offenders. Information might include "So-and-So is asleep in room whatever of some hotel something in somewhere with an extradition treaty even if the last thing they remember is walking into a Moscow bar." Apart from delivering results it would leave then wondering how far they can trust those around them.