{ "slug": "lockbit5", "group": "lockbit5", "name": "LockBit 5.0", "note": "ATT&CK models LockBit 3.0; 5.0 is its successor build.", "attck": [ { "id": "S1202", "name": "LockBit 3.0", "kind": "malware", "url": "https://attack.mitre.org/software/S1202" } ], "activity": { "postings": 64, "first": "2026-08-16", "last": "2026-11-04", "countries": { "BR": 4, "ID": 1, "TH": 2, "MX": 3, "IT": 5, "LB": 1, "LI": 1, "ES": 1, "TR": 1, "US": 10, "MY": 1, "EG": 1, "AU": 1, "FR": 3, "GR": 1, "HT": 1, "DE": 7, "AR": 2, "KR": 1, "KZ": 1, "SO": 1, "CL": 1, "TW": 1, "FI": 1, "NL": 6, "ZA": 1, "JP": 1, "TN": 1, "CZ": 1, "BE": 1, "PT": 1 }, "sectors": { "unknown": 19, "finance": 5, "education": 1, "services": 13, "consumer": 4, "healthcare": 8, "manufacturing": 5, "agriculture": 2, "technology": 4, "government": 1, "energy": 2 }, "recent": [ { "date": "2026-11-04", "name": "centratamagroup.com", "country": "BR", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/Y2VudHJhdGFtYWdyb3VwLmNvbUBsb2NrYml0NQ" }, { "date": "2026-11-01", "name": "synergy.co.id", "country": "ID", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/c3luZXJneS5jby5pZEBsb2NrYml0NQ" }, { "date": "2026-10-29", "name": "xspringcapital.com", "country": "TH", "sectors": [ "finance" ], "url": "https://www.ransomware.live/id/eHNwcmluZ2NhcGl0YWwuY29tQGxvY2tiaXQ1" }, { "date": "2026-10-29", "name": "susannecerda.com", "country": "MX", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/c3VzYW5uZWNlcmRhLmNvbUBsb2NrYml0NQ" }, { "date": "2026-10-23", "name": "dorsiacademy.it", "country": "IT", "sectors": [ "education" ], "url": "https://www.ransomware.live/id/ZG9yc2lhY2FkZW15Lml0QGxvY2tiaXQ1" }, { "date": "2026-10-23", "name": "mlh.com.lb", "country": "LB", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/bWxoLmNvbS5sYkBsb2NrYml0NQ" }, { "date": "2026-10-23", "name": "lidoway.com", "country": "LI", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/bGlkb3dheS5jb21AbG9ja2JpdDU" }, { "date": "2026-10-23", "name": "zelsior.es", "country": "ES", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/emVsc2lvci5lc0Bsb2NrYml0NQ" }, { "date": "2026-10-22", "name": "istanbultrading.com", "country": "TR", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/aXN0YW5idWx0cmFkaW5nLmNvbUBsb2NrYml0NQ" }, { "date": "2026-10-19", "name": "chooseultimate.com", "country": "US", "sectors": [ "consumer" ], "url": "https://www.ransomware.live/id/Y2hvb3NldWx0aW1hdGUuY29tQGxvY2tiaXQ1" }, { "date": "2026-10-17", "name": "ock.com.my", "country": "MY", "sectors": [ "unknown" ], "url": "https://www.ransomware.live/id/b2NrLmNvbS5teUBsb2NrYml0NQ" }, { "date": "2026-10-15", "name": "torcivialaw.com", "country": "IT", "sectors": [ "services" ], "url": "https://www.ransomware.live/id/dG9yY2l2aWFsYXcuY29tQGxvY2tiaXQ1" } ] }, "convergences": [ { "name": "ADT, Inc.", "flagged": "2026-08-24", "classes": [ "leak", "notice" ], "curated": false, "hand_picked": false } ], "reports": [ { "url": "https://securelist.com/storm-2603-fileless-toolshell-attack/121467/", "publisher": "Kaspersky Securelist", "published": "2026-11-05", "title": "The SOC Files 5: Ghost in the pipeline, or a fileless SharePoint breach by Storm-2603", "origin": "feed", "primary": false }, { "url": "https://reliaquest.com/blog/finance-and-insurance-faces-a-122-percent-ransomware-spike-how-to-defend-against-it/", "publisher": "ReliaQuest", "published": "2026-11-05", "title": "Finance and Insurance Faces a 122% Ransomware Spike. Here’s How to Defend Against It.", "origin": "feed", "primary": false }, { "url": "https://www.intel471.com/blog/why-is-italy-a-top-target-for-cybercrime", "publisher": "Intel 471", "published": "2026-11-04", "title": "Why is Italy a top target for cybercrime?", "origin": "feed", "primary": false }, { "url": "https://flare.io/learn/resources/blog/shinyhunters-arrests-brand-name-fight", "publisher": "Flare", "published": "2026-11-04", "title": "Aftermath of the September ShinyHunters Arrests: Battle Over the Brand Name", "origin": "feed", "primary": false }, { "url": "https://reliaquest.com/blog/threat-spotlight-ransomware-and-cyber-extortion-in-q3-2026/", "publisher": "ReliaQuest", "published": "2026-11-03", "title": "Ransomware and Cyber Extortion in Q3 2026", "origin": "feed", "primary": false }, { "url": "https://www.guidepointsecurity.com/blog/silent-ransom-group-leaked-chats/", "publisher": "GuidePoint GRIT", "published": "2026-10-15", "title": "Behind the Help Desk Call: Insights from the Leaked Chats of an IT-Impersonation Extortion Crew", "origin": "feed", "primary": false }, { "url": "https://asec.ahnlab.com/en/95949/", "publisher": "AhnLab ASEC", "published": "2026-10-11", "title": "September 2026 Threat Trend Report on Ransomware", "origin": "feed", "primary": false }, { "url": "https://asec.ahnlab.com/en/96155/", "publisher": "AhnLab ASEC", "published": "2026-10-11", "title": "Security Issues in the Korean & Global Financial Sector in September 2026", "origin": "feed", "primary": false }, { "url": "https://flare.io/learn/resources/blog/healthcare-ransomware-attack-surface", "publisher": "Flare", "published": "2026-10-08", "title": "Healthcare Is Cybercrime’s Highest-Value Target: Ransomware, Exposure, and the Expanding Attack Surface", "origin": "feed", "primary": false }, { "url": "https://www.sekoia.com/blog/gotta-breach-em-all-the-journey-of-shinyhunters", "publisher": "Sekoia TDR", "published": "2026-09-24", "title": "Gotta Breach 'Em All! The Journey Of ShinyHunters", "origin": "feed", "primary": false }, { "url": "https://securelist.com/tr/payload-ransomware-via-group-policy/121335/", "publisher": "Kaspersky Securelist", "published": "2026-09-21", "title": "Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO", "origin": "feed", "primary": false }, { "url": "https://www.recordedfuture.com/blog/mexico-cybersecurity-plan", "publisher": "Recorded Future Insikt", "published": "2026-08-25", "title": "Mexico’s Cybersecurity Plan 2025-2030: Turning Ambition Into Defense", "origin": "feed", "primary": false }, { "url": "https://www.intel471.com/blog/a-new-era-of-bulletproof-hosting-providers-emerge", "publisher": "Intel 471", "published": "2026-08-19", "title": "A New Era of Bulletproof Hosting Providers Emerge", "origin": "feed", "primary": false } ], "techniques": [ { "id": "T1021.002", "name": "SMB/Windows Admin Shares", "tactics": [ "lateral-movement" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 38, "related": 10 }, { "id": "T1027.002", "name": "Software Packing", "tactics": [ "stealth" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 1, "related": 94 }, { "id": "T1027.013", "name": "Encrypted/Encoded File", "tactics": [ "stealth" ], "sources": [ "attck" ], "structural": false, "own": [ "t1557-claims-kit-single-letter-c2-xenc" ], "community": 0, "related": 94 }, { "id": "T1057", "name": "Process Discovery", "tactics": [ "discovery" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 8, "related": 0 }, { "id": "T1059.001", "name": "PowerShell", "tactics": [ "execution" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 220, "related": 94 }, { "id": "T1070.004", "name": "File Deletion", "tactics": [ "stealth" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 15, "related": 20 }, { "id": "T1071.001", "name": "Web Protocols", "tactics": [ "command-and-control" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 42, "related": 7 }, { "id": "T1078.003", "name": "Local Accounts", "tactics": [ "stealth", "persistence", "privilege-escalation", "initial-access" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 5, "related": 55 }, { "id": "T1082", "name": "System Information Discovery", "tactics": [ "discovery" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 33, "related": 0 }, { "id": "T1083", "name": "File and Directory Discovery", "tactics": [ "discovery" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 24, "related": 0 }, { "id": "T1106", "name": "Native API", "tactics": [ "execution" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 14, "related": 0 }, { "id": "T1112", "name": "Modify Registry", "tactics": [ "defense-impairment", "persistence" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 94, "related": 0 }, { "id": "T1120", "name": "Peripheral Device Discovery", "tactics": [ "discovery" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 2, "related": 0 }, { "id": "T1132.001", "name": "Standard Encoding", "tactics": [ "command-and-control" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 4, "related": 0 }, { "id": "T1135", "name": "Network Share Discovery", "tactics": [ "discovery" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 7, "related": 0 }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "tactics": [ "stealth" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 18, "related": 0 }, { "id": "T1218.003", "name": "CMSTP", "tactics": [ "stealth" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 7, "related": 153 }, { "id": "T1480", "name": "Execution Guardrails", "tactics": [ "stealth" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 0, "related": 0 }, { "id": "T1480.002", "name": "Mutual Exclusion", "tactics": [ "stealth" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 0, "related": 0 }, { "id": "T1484.001", "name": "Group Policy Modification", "tactics": [ "defense-impairment", "privilege-escalation" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 6, "related": 1 }, { "id": "T1486", "name": "Data Encrypted for Impact", "tactics": [ "impact" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 16, "related": 0 }, { "id": "T1489", "name": "Service Stop", "tactics": [ "impact" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 20, "related": 0 }, { "id": "T1490", "name": "Inhibit System Recovery", "tactics": [ "impact" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 27, "related": 0 }, { "id": "T1543.003", "name": "Windows Service", "tactics": [ "persistence", "privilege-escalation" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 47, "related": 9 }, { "id": "T1547.004", "name": "Winlogon Helper DLL", "tactics": [ "persistence", "privilege-escalation" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 4, "related": 7 }, { "id": "T1548.002", "name": "Bypass User Account Control", "tactics": [ "privilege-escalation" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 56, "related": 23 }, { "id": "T1569.002", "name": "Service Execution", "tactics": [ "execution" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 43, "related": 4 }, { "id": "T1573.001", "name": "Symmetric Cryptography", "tactics": [ "command-and-control" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 0, "related": 6 }, { "id": "T1614.001", "name": "System Language Discovery", "tactics": [ "discovery" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 2, "related": 0 }, { "id": "T1622", "name": "Debugger Evasion", "tactics": [ "stealth", "discovery" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 1, "related": 0 }, { "id": "T1680", "name": "Local Storage Discovery", "tactics": [ "discovery" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 0, "related": 0 }, { "id": "T1685", "name": "Disable or Modify Tools", "tactics": [ "defense-impairment" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 162, "related": 44 }, { "id": "T1685.005", "name": "Clear Windows Event Logs", "tactics": [ "defense-impairment" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 8, "related": 162 }, { "id": "T1688", "name": "Safe Mode Boot", "tactics": [ "defense-impairment" ], "sources": [ "attck" ], "structural": false, "own": [], "community": 0, "related": 0 } ], "cves": [], "indicators": { "list": [], "withheld": 0 }, "rules": [], "coverage": { "techniques": 34, "defendable": 34, "covered": 29, "uncovered": [ "T1480", "T1480.002", "T1573.001", "T1680", "T1688" ] } }