www.resecurity.com LockBit Ransomware Targets ICBC Financial Services and U.S. Bank
Article Content
- •LockBit ransomware attacked ICBC Financial Services, disrupting U.S. Treasury operations.
- •The attack exploited a vulnerability in Citrix NetScaler, affecting critical financial transactions.
- •LockBit 5.0 claimed a new breach of U.S. Bank, though details remain unverified.
On November 8, 2025, the LockBit ransomware group attacked ICBC Financial Services, disrupting U.S. Treasury trading operations. The attack exploited a vulnerability in Citrix NetScaler, leading to a $9 billion injection by ICBC to settle trades. The incident highlighted the vulnerability of the global financial system, particularly affecting repo transactions. On August 19, 2026, LockBit 5.0 claimed to have breached U.S. Bank, although this remains unverified. The attack's impact on U.S. Treasury bond auctions was significant, with poor demand attributed to the cyber event. LockBit's resurgence follows a previous crackdown in 2024, demonstrating the group's resilience and ongoing threat to financial institutions.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (10)
Following this threat?
Track Lockbit and ICBC Financial Services in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
PAYLOAD Ransomware Exploits Active Directory GPO for Disruption In April 2026, Kaspersky's Global Emergency Response Team (GERT) responded to a ransomware incident at a manufacturing organization in the Middle East. Attackers gained domain-admin-equivalent control via a compromised FortiGate SSL VPN account and created a malicious Group Policy Object (GPO) named PAYLOAD. This GPO… 
Threat Actors Exploit Windows Shadow Copies for Ransomware and Credential Theft Cybercriminals are increasingly abusing Microsoft’s Volume Shadow Copy Service (VSS) to facilitate ransomware attacks and steal credentials. They achieve this by deleting recovery options before deploying ransomware and extracting sensitive data from protected files, including the Active Directory database. Tools such…