LockBit 5.0: Understanding the Latest Developments in Ransomware Threats

Overview

LockBit ransomware is one of the most active and notorious ransomware-as-a-service (RaaS) operations, first appearing in 2019 and having evolved through versions that we have analyzed and written about here and here. Last year, it was reported that law enforcement seized LockBit’s infrastructure and arrested affiliates, but several copycats and spinoffs still surfaced. This week, we analyzed the newest variant, LockBit 5.0.

Infection Cycle

The newest LockBit variant introduces support for command-line parameters, a capability that was not present in previous versions. Using the -h parameter displays a help menu outlining the available command-line options.

Fig1._Lockbit-h.png — Figure 1: LockBit 5.0 usage options

These include basic settings such as specifying target directories for encryption or directories to exclude, choosing whether the ransomware runs in stealth mode or with visible debug output, and controlling how ransom notes are deployed (either none or in all directories). Additional options allow operators to select encryption modes, apply filters (such as preventing the deletion of executable files), enable multiple instances of the malware, or configure a delay before the encryption process begins.

When executing in verbose mode, the program opens a console window with a status bar and provides an option to press ‘a’ to abort the operation.

Fig2._Lockbitverbose.png — Figure 2: LockBit console window in verbose mode

However, if launched without parameters specified, it spawns the legitimate Windows utility defrag.exe to iterate through target files and carry out the encryption process.

Fig3.spawndefrag.png — Figure 3: Ransomware launches defrag.exe

It appends a random 16-character extension to encrypted files.

fig4.defrag_encryptingfiles.png — Figure 4: defrag.exe carrying out the encryption process

Fig5.encrypted_files.png — Figure 5: Encrypted files with a random 16-character extension

It then adds the ransomware note named ReadMeForDecrypt.txt to every directory with encrypted files.

Fig6.defrag_create_ransomnote.png — Figure 6: defrag.exe adds ransomware notes to every directory

Fig7._contents-ransomnote.png — Figure 7: Contents of the LockBit ransom note with decryption instructions

Recently, LockBit’s official leak site was compromised and defaced with the message “Don’t do crime. Crime is bad.” The incident was first reported on X by a user under the handle “xoxofromprague,” who is believed to be responsible for the breach. Multiple cybersecurity sources have since confirmed the compromise.

Today, LockBit’s onion site referenced in its ransom notes requires the submission of a unique access key (52 Base32 or 44 Base64 characters) as the initial authentication layer.

Fig_8.onionwebsiteneedkey.png — Figure 8: LockBit onion site requiring an authentication key to enter

The affiliate portal has also implemented additional security controls, including CAPTCHA verification, mandatory account registration, and a $500 access fee payable in BTC or XMR to obtain entry to the ransomware control panel.

Fig_9._captcha.png — Figure 9: LockBit affiliate portal requires CAPTCHA verification

Fig10.registrationfee.png — Figure 10: LockBit affiliate registration requires a $500 cryptocurrency fee

Protection

Since its emergence in 2019, LockBit has built one of the most durable and profitable Ransomware-as-a-Service (RaaS) operations in the cyber threat landscape. Despite multiple law enforcement disruptions, which resulted in seizures of infrastructure, arrests, and freezing of cryptocurrency wallets, LockBit has consistently recovered, adapted, and continued operations.

Recent operational enhancements (for example, stricter access controls, paywalls, and key-based authentication on their onion sites) further demonstrate that the group is investing in resiliency and infrastructure hardening. These changes indicate that LockBit’s RaaS model remains active and is unlikely to be disabled by law enforcement in the near term.

SonicWall Capture Labs provides protection against this threat via the following signature:

GAV: Lockbit.RSM_8 (Trojan)

This threat is also detected by SonicWall Capture ATP with RTDMI™ and the Capture Client endpoint solution.

Share This Article

An Article By

Security News

The SonicWall Capture Labs Threat Research Team gathers, analyzes and vets cross-vector threat information from the SonicWall Capture Threat network, consisting of global devices and resources, including more than 1 million security sensors in nearly 200 countries and territories. The research team identifies, analyzes, and mitigates critical vulnerabilities and malware daily through in-depth research, which drives protection for all SonicWall customers. In addition to safeguarding networks globally, the research team supports the larger threat intelligence community by releasing weekly deep technical analyses of the most critical threats to small businesses, providing critical knowledge that defenders need to protect their networks.