← Back to all threat actors

lockbit5

LockBit 5.0 ("ChuongDong") emerged in September 2025 as the group's resurgence following the February 2024 law enforcement takedown, introducing cross-platform payloads targeting Windows, Linux, and VMware ESXi with enhanced evasion capabilities and continuing the RaaS affiliate model of its predecessors.

How we source and review actor profiles

Motivation

ransomware

First seen

2026-04-14

Last seen

2026-10-23

Sectors

manufacturing, professional-services, technology, healthcare, agriculture-and-food-production, retail-e-commerce, education, hospitality, government-defense, other, financial-services, business-services

Status

Active

Activity timeline

A dated ledger of actor-claimed victims, campaigns, indicators, identity mappings, relationships, and CVE links. Each date states what it measures. For extensive leak-site histories, victim entries are limited to the 100 most recent distinct listings.

2026-10-23Claimed

Victim claimzelsior.es listed by lockbit5

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2026-10-23Claimed

Victim claimlidoway.com listed by lockbit5

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2026-10-23Claimed

Victim claimmlh.com.lb listed by lockbit5

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2026-10-23Claimed

Victim claimdorsiacademy.it listed by lockbit5

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2026-10-23Last observed

Indicator23 indicators cataloged

Types: onion.

2026-10-22Claimed

Victim claimistanbultrading.com listed by lockbit5

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2026-10-19Claimed

Victim claimchooseultimate.com listed by lockbit5

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2026-10-16First listed

Victim claimock.com.my listed by lockbit5

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2026-10-15Claimed

Victim claimgrupoabg.com listed by lockbit5

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2026-10-15Claimed

Victim claimneweramachines.com listed by lockbit5

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2026-10-15Claimed

Victim claimlcww.com.eg listed by lockbit5

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2026-10-15Claimed

Victim claimkidzrkooldental.com listed by lockbit5

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2026-10-15Claimed

Victim claimtorcivialaw.com listed by lockbit5

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2026-10-15First listed

Victim claimkarix.com listed by lockbit5

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2026-10-14Claimed

Victim claimkordhotels.gr listed by lockbit5

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2026-10-13First listed

Victim claimskycc.co.th listed by lockbit5

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2026-10-10First listed

Victim claimpoolegroup.com.au listed by lockbit5

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2026-10-10First listed

Victim claimsaintpierredescorps.fr listed by lockbit5

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2026-10-07First listed

Victim claimgrunenwald.com listed by lockbit5

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2026-10-07First listed

Victim claimavsa.com.ar listed by lockbit5

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2026-10-05First listed

Victim claimcapitalbankhaiti.biz listed by lockbit5

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2026-10-01First listed

Victim claimconsilio.com listed by lockbit5

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2026-09-29First listed

Victim claimspg.co.kr listed by lockbit5

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2026-09-28First listed

Victim claimcamorim.com.br listed by lockbit5

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2026-09-24First listed

Victim claimcorisricambi.it listed by lockbit5

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

The interactive view includes 101 dated events with category filters and paging.

Identity and attribution

Exact names and tracking identifiers resolve to this canonical profile. Rebrands, affiliations, and overlapping clusters remain separate confidence-rated relationships.

Name map

lockbit5Canonical Name

Loading CVEs, techniques, indicators, malware, victims, and activity...