Applied Cybernetics Group Sat, Nov 7, 2026 · data 12:17Z
thrunt.me thrunt me harder

Hunt / lockbit5

LockBit 5.0

S1202 LockBit 3.0

ATT&CK models LockBit 3.0; 5.0 is its successor build.

64victims, 90d
Nov 4last post
0reports about them
29/34techniques with a rule
0indicators

Who they hit

  • Unclassified19
  • Professional services13
  • Healthcare8
  • Finance5
  • Manufacturing5
  • Retail & consumer4
  • US10
  • DE7
  • NL6
  • IT5
  • BR4
  • MX3
PostedVictimCountrySector
2026-11-04centratamagroup.comBRUnclassified
2026-11-01synergy.co.idIDUnclassified
2026-10-29xspringcapital.comTHFinance
2026-10-29susannecerda.comMXUnclassified
2026-10-23dorsiacademy.itITEducation
2026-10-23mlh.com.lbLBProfessional services
2026-10-23lidoway.comLIUnclassified
2026-10-23zelsior.esESUnclassified
2026-10-22istanbultrading.comTRRetail & consumer
2026-10-19chooseultimate.comUSRetail & consumer
2026-10-17ock.com.myMYUnclassified
2026-10-15torcivialaw.comITProfessional services

Latest 12 of 64, from ransomware.live. These are the group's claims.

Confirmed elsewhere

Victims of LockBit 5.0 that a second, independent source also named inside two weeks. How convergence works.

What they do

34 techniques, in kill-chain order. 5 have no rule anywhere we can find. "Their side" is infrastructure work you can't see from your network.

IDTechniqueSourceSigmaHQStatus
T1078.003 Local Accounts mitre 5 SigmaHQ
T1059.001 PowerShell mitre 220 SigmaHQ
T1106 Native API mitre 14 SigmaHQ
T1569.002 Service Execution mitre 43 SigmaHQ
T1112 Modify Registry mitre 94 SigmaHQ
T1543.003 Windows Service mitre 47 SigmaHQ
T1547.004 Winlogon Helper DLL mitre 4 SigmaHQ
T1484.001 Group Policy Modification mitre 6 SigmaHQ
T1548.002 Bypass User Account Control mitre 56 SigmaHQ
T1057 Process Discovery mitre 8 SigmaHQ
T1082 System Information Discovery mitre 33 SigmaHQ
T1083 File and Directory Discovery mitre 24 SigmaHQ
T1120 Peripheral Device Discovery mitre 2 SigmaHQ
T1135 Network Share Discovery mitre 7 SigmaHQ
T1614.001 System Language Discovery mitre 2 SigmaHQ
T1622 Debugger Evasion mitre 1 SigmaHQ
T1680 Local Storage Discovery mitre nothing
T1021.002 SMB/Windows Admin Shares mitre 38 SigmaHQ
T1071.001 Web Protocols mitre 42 SigmaHQ
T1132.001 Standard Encoding mitre 4 SigmaHQ
T1573.001 Symmetric Cryptography mitre ~6 close only
T1486 Data Encrypted for Impact mitre 16 SigmaHQ
T1489 Service Stop mitre 20 SigmaHQ
T1490 Inhibit System Recovery mitre 27 SigmaHQ
T1027.002 Software Packing mitre 1 SigmaHQ
T1027.013 Encrypted/Encoded File mitre ~94 thrunt
T1070.004 File Deletion mitre 15 SigmaHQ
T1140 Deobfuscate/Decode Files or Information mitre 18 SigmaHQ
T1218.003 CMSTP mitre 7 SigmaHQ
T1480 Execution Guardrails mitre nothing
T1480.002 Mutual Exclusion mitre nothing
T1685 Disable or Modify Tools mitre 162 SigmaHQ
T1685.005 Clear Windows Event Logs mitre 8 SigmaHQ
T1688 Safe Mode Boot mitre nothing

SigmaHQ counts are rules tagged with that exact technique; "~n" is rules on its parent or sub-techniques. A close match does not mean the technique is covered.

Rules to deploy

Ours on the same techniques but written for something else, so check the logic fits before you lean on them: t1557-claims-kit-single-letter-c2-xenc.

Sweep

No indicators. Either nobody has published any for LockBit 5.0, or the reports cite values without marking them as IOCs. package.json