LockBit 5.0 Ransomware: Cross-Platform Evolution Targets Windows, Linux, and ESXi

Trend Research has released an in-depth analysis showing that LockBit 5.0 is not limited to Windows, continuing a cross‑platform strategy that targets Windows, Linux and ESXi to attack entire enterprise networks, including virtualised environments. The researchers confirm that the Windows variant heavy obfuscation and packing, loading its payload through DLL reflection while patching ETW and terminating several security services, is part of the new approach.

The Linux variant provides a command‑line interface mirroring Windows and can target specific directories and file types with detailed affiliate logging, while the ESXi variant is designed to encrypt VMware virtualization infrastructure, potentially crippling dozens or hundreds of virtual machines in a single strike.

According to Trend Research, “The Windows binary uses heavy obfuscation and packing: it loads its payload through DLL reflection while implementing anti‑analysis techniques like ETW patching and terminating security services.” They also note that the ransomware clears event logs post‑encryption and uses randomized 16‑character file extensions, with a streamlined victim interaction model that directs victims to a dedicated leak site for negotiations.