LockBit 5.0 Sustains Global Ransomware Dominance

LockBit 5.0 is described as a continued evolution in automation and speed, with the ransomware group maintaining its position at the top of the global threat landscape despite law enforcement crackdowns. The operation runs on a Ransomware-as-a-Service model, where core developers create the encryption malware and affiliates conduct intrusions. According to the AhnLab report, LockBit accounted for 30.25% of known ransomware attacks from August 2021 to August 2022, and around 21% of attacks in 2023.

The latest variant targets a broad range of sectors, including IT, electronics, law firms and churches, and the group maintains a Data Leak Site to shame victims who refuse to pay. The ransom notes promote “Premium Criminal Branding Services” and even tout a “data breach delay” or remediation, while the attackers publicly muse about preferring profits over law enforcement heat. Security experts warn that LockBit 5.0 demonstrates resilience and urges organisations to prepare for rapid data exfiltration before encryption.