New Analysis Reveals LockBit 5.0’s Core Features and Dual-Stage Attack Model

LockBit 5.0 introduces a refined two-stage ransomware deployment model designed to maximise evasion, modularity and destructive impact. The two-stage execution model separates a stealthy loader from the core payload, with stage one focusing on anti-analysis techniques such as control-flow obfuscation, dynamic API resolution and library unhooking to enable stealthy payload delivery.

Stage two features a destructive ransomware payload, labelled “ChuongDoung Locker v1.01” by Flashpoint, and supports modes including a “destruction-only” option that encrypts files without altering extensions or displaying a ransom note. The attacker tooling also includes multi-threaded encryption, disabled system services, and continued use of familiar LockBit capabilities alongside new options, while staying operational after prior law enforcement takedowns and a May 2025 internal-leak.

Security teams should monitor for evidence of the loader’s evasion techniques and defenders should prioritise patching, behavioural detection and prepared responses, according to Flashpoint.