LockBit 5.0 & Ransomware Cartel: What You Need To Know?

LockBit 5.0 marks the latest step in the group’s evolution, described as more modular with faster encryption and improved evasion, following a 2019 rebrand from ABCD to LockBit and a refresh of its affiliate programme. In February 2024, the group suffered a major setback during Operation Cronos, a multinational law enforcement campaign that seized infrastructures and exposed affiliate details, leading observers to believe a decline might follow.

Despite this, recent signs of a resurrection have appeared as LockBit 5.0 emerged on the onion network and in underground forums, with affiliates re-engaging and new incentives reported. The article also explains how the Ransomware Cartel idea took shape when DragonForce publicly invited LockBit and Qilin to cooperate, proposing equal competition conditions and shared profits to reduce infighting.

On the 2025 landscape, law enforcement has had some successes but affiliates now move between RaaS offerings, with DragonForce and Qilin described as rising fast and attracting affiliates who formerly favoured other groups. Defenders are urged to watch for a potential cartel that could raise the technical bar and stabilise profits for criminals.