lockbit5
ransomware group · aka LockBit 5.0, LockBit, LockBit 4.0, LockBit Black (LockBit 3.0 branding), Bitwise Spider (operator-side branding) · Russia (suspected); alleged leader 'LockBitSupp' identified as Russian national Dmitry Khoroshev per U.S. DOJ (2024) · active since Original LockBit first observed September 2019; 'LockBit 5.0' branding reported by vendors in 2025; exact 5.0 first-observed date unknown; this dashboard's leak-site tracking began 2026-09-04
Victims · 7d
5▼1
Victims · 30d
27active targets
Victims · 90d
86
All-time (tracked)
360since 2025-12-05
Last post
09-14 18:42UTC
Estimated earnings
Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit…public reporting
Profile · glm-5.3-flash · updated
LockBit 5.0 is the latest version of the long-running LockBit ransomware-as-a-service brand, one of the most prolific RaaS operations observed since 2019. The operation uses an affiliate model and double extortion, publishing non-paying victims and stolen data on its leak site, consistent with the victim cadence tracked here. In February 2024, international law enforcement (Operation Cronos, FBI/NCA and partners) seized servers and disrupted the group, and the U.S. DOJ subsequently identified alleged leader LockBitSupp as Russian national Dmitry Khoroshev. LockBit continued operating after the disruption, with vendor reporting through 2025 describing ongoing victim postings; technical details unique to the 5.0 encryptor are not well documented publicly. Well-documented tradecraft includes VPN and edge-device exploitation for initial access, the custom StealBit exfiltration tool, and pressure tactics such as countdown timers on its leak site.
Tactics & tooling
- Double extortion: file encryption plus data exfiltration with leak-site publication
- Ransomware-as-a-service affiliate model with recruited access brokers
- Initial access via exploited VPN and edge devices, and stolen credentials (per CISA/FBI #StopRansomware advisories)
- Exploitation of known vulnerabilities, including FortiOS, Zerologon, PrintNightmare, Follina, and Citrix Bleed
- Custom StealBit exfiltration tool; loader-based delivery (e.g., QakBot) observed in affiliate intrusions per vendor reporting
- Intermittent encryption for speed; disables security software, deletes shadow copies, reboots into safe mode (per CISA/FBI advisories)
- Leak-site pressure tactics: countdown timers, victim shaming, reposting of non-payers
Targeted sectors
manufacturingprofessional and legal serviceshealthcareconstruction and engineeringfinancial servicestransport and logisticsIT and managed services
Notable public victims
Royal Mail Group (UK postal service; 2022-2023), Boeing (2023; intrusion linked to Citrix Bleed, CVE-2023-4966), ICBC Financial Services (2023), Continental AG (2022), Accenture (2021), TSMC (2023; via supplier Kinmax per public reporting), Bridgestone Americas (2022)
CVEs linked to their intrusions
Estimated earnings
Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit… — Public reporting: U.S. DOJ/UK NCA joint announcement on Operation Cronos (February 2024); no verified public figure specific to version 5.0.
Leak-site victims360 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| uni-china.com | · Jun 9, 2026 | Uni-China Group is a Hong Kong-based conglomerate with a history spanning more than 25 years. It spe... |
| patta.com | · Jun 9, 2026 | PATTA is a brand-focused manufacturer, distributor, and exporter providing a total-solution concept... |
| elumax.com | · Jun 9, 2026 | Lumax International Corp. is a Taiwanese supplier of industrial solutions and equipment, founded in... |
| gursoygrup.com.tr | · May 19, 2026 | Gürsoy Grup is a leading company in Turkey with over 30 years of experience, operating in seven sect... |
| irestal.com | · May 19, 2026 | Irestal Group has over 80 years of experience providing stainless steel solutions, with a service ce... |
| ritta.co.th | · May 19, 2026 | RITTA is a leading design and construction service provider in Thailand, specializing in a wide rang... |
| orekait.com | · May 19, 2026 | Oreka IT is a technology services company that works closely with Euskal Trenbide Sarea (Basque Rail... |
| de.yangming.com | · May 19, 2026 | Yang Ming Marine Transport Corporation is a major Taiwanese shipping line whose German division man... |
| anser-coding.com | · May 19, 2026 | FOUNDED IN 1986 ANSER is one of the world leading solution provider of product coding & marking equ... |
| rhactushotel.com | · May 19, 2026 | Rhactus Hotel is a premier accommodation provider located in El-Alamein, Egypt, offering a variety o... |
| vp-brands.com | · May 19, 2026 | We produce quality spirits, evolve brands and push boundaries. As far as it takes. |
| dentoncalvary.org | · May 19, 2026 | Denton Calvary Academy is a K-12 University-Model school that focuses on fostering a love of learnin... |
| jec.co.id | · May 19, 2026 | JEC Eye Hospitals and Clinics is a trusted eye hospital in Indonesia, offering advanced services in... |
| santoinacio-rio.com.br | · May 19, 2026 | Colégio Santo Inácio, part of the Jesuit Education Network, has been providing quality education sin... |
| lbreng.com.br | · May 19, 2026 | LBR Engenharia is a consulting and engineering company specializing in innovative solutions for qual... |
| stahlwille.nl | · May 19, 2026 | Stahlwille BV is a company that operates in the Investment Banking industry. It employs 100to249 peo... |
| shougang.com.pe | · May 19, 2026 | SHOUGANG HIERRO PERU S.A.A. is a civil association focused on iron production. The company is involv... |
| centralromana.com.do | · May 19, 2026 | Established in 1912, Central Romana Corporation is the leading agro-industrial and tourism company i... |
| planetsport.ma | · Apr 29, 2026 | Planet Sport is your go-to online store for sports gear in Morocco. They help athletes and fitness f... |
| pricon.com.ph | · Apr 29, 2026 | Pricon Microelectronics, Inc. (PMI) is an Original Equipment Manufacturer (OEM) and a subsidiary of... |
| instapack.es | · Apr 29, 2026 | Instapack is a professional courier service with over 30 years of experience, offering immediate del... |
| stllc.org | · Apr 29, 2026 | Welcome to St. Luke Lutheran Community St. Luke Lutheran Community is a not-for-profit, continuing... |
| bladex.com | · Apr 26, 2026 | Bladex, a multinational bank originally established by the central banks of Latin-American and Carib... |
| heinrichs-logistic.de | · Apr 26, 2026 | D. Heinrichs Logistic GmbH is a leading logistics service provider based in Bremerhaven, specializin... |
| merlo.de | · Apr 26, 2026 | Merlo Teleskoplader: von Profis für Profis Teleskoplader für jeden Einsatz – plus Dienstleistung! M... |
| comunidadandina.org | · Apr 22, 2026 | La Comunidad Andina (CAN) es un organismo internacional de integración subregional fundado el 26 de... |
| fondonorma.org.ve | · Apr 22, 2026 | Fondonorma is a Venezuelan certification company that helps businesses prove they meet quality and s... |
| cegasa.com | · Apr 22, 2026 | Cegasa is a leading European company specializing in innovative energy solutions, particularly lithi... |
| nucleodediagnostico.mx | · Apr 22, 2026 | Núcleo de Diagnóstico Núcleo de Diagnóstico es un laboratorio de análisis clínicos ubicado en Guada... |
| marti.do | · Apr 22, 2026 | ABOUT THE GROUP Somos un grupo empresarial con más de 60 años de experiencia, sirviendo con entusia... |
| decaturdiagnosticlab.net | · Apr 22, 2026 | Located inside the Med-Surg Complex; Decatur Diagnostic Lab is a privately owned lab servicing the D... |
| studiopiu.net | · Apr 22, 2026 | Di fronte al Lago di Garda, a Desenzano, batte uno dei cuori storici della radiofonia dance italiana... |
| murni.co.id | · Apr 22, 2026 | PT Murni Solusindo Nusantara is an ICT-based solution provider company with ISO 9001:2015 certificat... |
| bardehle.com | · Apr 22, 2026 | BARDEHLE PAGENBERG is a leading intellectual property law firm in Europe, specializing in patent lit... |
| erstransportes.com.br | · Apr 22, 2026 | A ERS Transportes, iniciou suas atividades em 2003, transportando cargas em equipamentos porta contê... |
| fastindustria.com.br | · Apr 6, 2026 | Fast Tecnologia Industrial specializes in industrial equipment and systems for wastewater treatment... |
| gas.mercedes-benz.com.eg | · Apr 6, 2026 | Mercedes-Benz, founded in 1967 and headquartered in Giza, Egypt, is a automobile dealer and motor ve... |
| abuhatim.com | · Apr 6, 2026 | Abu Hatim Co LLC is an Excellent Grade Engineering Construction Company established in 1991, special... |
| milanocavi.com | · Apr 6, 2026 | Wineuropa is a web agency based in Arezzo that specializes in web marketing, SEO services, and websi... |
| zsfh.cz | · Apr 6, 2026 | Základní škola a Mateřská škola F. Hrubína Havířov-Podlesí |
| contrar.it | · Apr 6, 2026 | Il consorzio CON.TR.AR. nasce nel 1985 dall’aggregazione di alcuni padroncini artigiani che sentiron... |
| awvgrazerfeld.at | · Apr 6, 2026 | Verwaltung Unter dem Motto "Weg vom Kostenumleger und hin zum Dienstleister" hat sich die Geschäfts... |
| douglasstruckbodies.com | · Apr 6, 2026 | Douglass Truck Bodies specializes in the manufacturing and design of standard and custom truck bodie... |
| mesto-jemnice.cz | · Apr 6, 2026 | Historie města Jemnice Město Jemnice je správním, hospodářským a kulturním střediskem kraje mezi Da... |
| meyzietp.com | · Apr 6, 2026 | Fondée en 1954, l’entreprise MEYZIE TP est spécialisée dans les travaux de terrassements routiers et... |
| pegasussrl.com | · Apr 6, 2026 | Agenzia Unipol Assicurazioni 39547 Prato - Pegasus srl Agenzia 39547 Prato R.U.I. N. A000671187- P.... |
| villa-romane.fr | · Apr 6, 2026 | Villa Romane, constructeur de maison à Perpignan Fondée en 1982, Villa Romane est une entreprise fa... |
| vitropor.pt | · Apr 6, 2026 | Tal como o nosso vidro, somos transparentes, seguros e resistentes. Com mais de 30 anos na indústri... |
| defcon5italy.com | · Apr 6, 2026 | Our mission is in our name DEFCON, the U.S. acronym for DEFense CONdition, tells of the highest deg... |
| vitexpharma.com | · Apr 6, 2026 | Vitex Pharmaceuticals is Australia's leading contract manufacturer specializing in vitamins, mi... |
In the newsAll →
No articles mention this group yet.
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .