LockBit 5.0 Resurfaces Stronger: New Variant Blinds Defenders by Disabling Windows ETW for Stealth Encryption

LockBit 5.0 has resurfaced as a cross‑platform, stealth‑focused variant, with researchers saying it is significantly more dangerous than its predecessors. A new technical report from Picus Labs reveals the group’s latest version targets Windows, Linux and VMware ESXi with a unified command‑line interface and introduces Invisible and Anti‑Forensics modes to broaden its operational scope.

The ransomware now patches the EtwEventWrite API in user mode, overwriting the function’s beginning with a return instruction (0xC3) to disable Windows Event Tracing and blunt detection, and it also executes the EvtClearLog API to wipe event logs upon completion. The campaign continues to use a double extortion tactic, encrypting data while threatening to leak it, and the report notes that stolen data was frequently retained even after ransoms were paid during Operation Cronos.

The resurgence follows a February 2024 disruption that compromised LockBit’s administration panel and decrypted keys, with the group declaring its return in early September 2025 for its sixth anniversary. 9 December 2025. according to Picus Labs