LockBit 5.0 Ransomware Targets Windows, Linux, and VMware ESXi Systems

Cybersecurity researchers at Trend Micro have identified a new variant of LockBit ransomware, LockBit 5.0, which targets Windows, Linux and VMware ESXi systems and uses advanced obfuscation and cross‑platform capabilities. The Windows variant loads its payload through DLL reflection and employs anti‑analysis techniques including ETW patching and automatic termination of security services, while the Linux variant offers command‑line options to target specific directories and file types.

The ESXi variant is particularly concerning because it can encrypt entire virtual machine environments on VMware infrastructure with a single execution. As with prior LockBit versions, it also includes geopolitical safeguards that terminate execution when Russian language settings or geolocation are detected, and it generates randomized 16‑character file extensions to complicate recovery.

The report notes that, despite Operation Cronos in February 2024 disrupting LockBit infrastructure, the group has demonstrated resilience, with LockBit 5.0 delivering faster encryption and enhanced evasion within a cross‑platform ransomware‑as‑a‑service framework.