LockBit 5.0 Targets Windows, Linux, and ESXi Systems in Ongoing Attacks

LockBit 5.0 now targets Windows, Linux and ESXi environments, expanding the threat landscape to hybrid and virtualised infrastructures, with researchers noting a high activity level in September 2025. In that month, a dozen organisations were identified as victims of the revived operation, and the new variant accounted for about half of the attacks observed.

According to Check Point Research, LockBit is actively extorting organisations across multiple continents, with the newly launched variant internally designated “ChuongDong” establishing itself as a significant enterprise threat. The group’s administrator, LockBitSupp, publicly announced the operation’s return at the start of September and began recruiting new affiliates, reinforcing its presence on underground forums.

Technical evolution in 5.0 includes enhanced anti-analysis, stronger encryption and a randomised 16-character file extension scheme, while the affiliate control panel has gained upgraded management features and individual credentials; deposits of approximately $500 in Bitcoin are required to access the panel and encryptor packages. About 80% of observed attacks targeted Windows systems, with roughly 20% aimed at ESXi and Linux environments.