Thecyberexpress

LockBit Ransomware Group Launches New Data Leak Site and Upgrades to Version 5.0

First seen 5 Dec 2025, 19:45 UTC • Flashpoint

•66.9

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

The LockBit ransomware group has returned with a new data leak site, claiming seven new victims. Following a series of law enforcement actions in early 2024 that disrupted its operations, LockBit has introduced version 5.0 in late September 2025, featuring a refined modular two-stage deployment model aimed at enhancing evasion and bypassing endpoint detection and response systems.

How this analysis works

Attack Flow

14 entities, 33 inferred relationships (STIX 2.1).

Technique (3)

Ransomware
T1055.012 - Process Hollowing
T1055 - Process Injection

Malware (2)

ABCD ransomware
ChuongDoung Locker

Affected Platform (3)

Linux
VMware ESXi
Windows

Threat Actor (5)

Akira
Cl0p
Lockbit
Play
Qilin

Tool (1)

defrag.exe

Relationships

Akira uses ABCD ransomware
Akira uses ChuongDoung Locker
Cl0p uses ABCD ransomware
Cl0p uses ChuongDoung Locker
Lockbit uses ABCD ransomware
Lockbit uses ChuongDoung Locker
Play uses ABCD ransomware
Play uses ChuongDoung Locker
Qilin uses ABCD ransomware
Qilin uses ChuongDoung Locker
Akira uses defrag.exe
Cl0p uses defrag.exe
Lockbit uses defrag.exe
Play uses defrag.exe
Qilin uses defrag.exe
Akira uses Ransomware
Akira uses T1055.012 - Process Hollowing
Akira uses T1055 - Process Injection
Cl0p uses Ransomware
Cl0p uses T1055.012 - Process Hollowing
Cl0p uses T1055 - Process Injection
Lockbit uses Ransomware
Lockbit uses T1055.012 - Process Hollowing
Lockbit uses T1055 - Process Injection
Play uses Ransomware
Play uses T1055.012 - Process Hollowing
Play uses T1055 - Process Injection
Qilin uses Ransomware
Qilin uses T1055.012 - Process Hollowing
Qilin uses T1055 - Process Injection
Akira related to Linux
Akira related to VMware ESXi
Akira related to Windows

Continue Reading

Critical SonicWall SMA1000 Vulnerabilities Under Active Exploitation Akira Ransomware Group Targets Critical Infrastructure, Extracts $42 Million Persistent Firestarter Malware Targets Cisco Firepower Devices in US Agencies Exploitation of Remote Services in Cyber Attacks CVE-2024-40766 Exploited by Ransomware Groups Targeting SonicWall Firewalls Ransomware Group Targets SonicWall Gen 7 Firewalls via CVE-2024-40766

LockBit Ransomware Group Launches New Data Leak Site and Upgrades to Version 5.0

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading