Ransomware group profile · #19 by claimed victims

Lockbit5 ransomware

LockBit 5.0 ("ChuongDong") emerged in September 2025 as the group's resurgence following the February 2024 law enforcement takedown, introducing cross-platform payloads targeting Windows, Linux, and VMware ESXi with enhanced evasion capabilities and continuing the RaaS affiliate model of its predecessors.

Active First seen Dec 2025

370Victims claimed on leak sites

35Victims in the last 30 days

92Victims in the last 90 days

68Countries hit

6Leak-site URLs tracked, 1 online

14 Sep 2026Latest claim recorded

Victimology

Who Lockbit5 claims to have breached, from 370 leak-site posts recorded by VULONE.

Claims per month last 12 months

Top sectors

Professional Services62

Manufacturing62

Technology48

Healthcare32

Agriculture and Food Production25

Retail & E-Commerce23

Education20

Government & Defense16

Top countries

United States66

Brazil28

Italy28

Germany25

Mexico16

Netherlands14

France13

India9

Latest claimed victims 12 most recent

Victim	Sector	Country	Claimed
tpi.tw	—	—	14 Sep 2026
comune.robeccosulnaviglio.mi.it	—	—	14 Sep 2026
httoy.fi	—	—	14 Sep 2026
tpi.tw tpi.tw	Technology	TW	14 Sep 2026
comune.robeccosulnaviglio.mi.it comune.robeccosulnaviglio.mi.it	Government & Defense	IT	14 Sep 2026
httoy.fi httoy.fi	Not Found	FI	14 Sep 2026
alphaomega-eng.com alphaomega-eng.com	Professional Services	DE	10 Sep 2026
alphaomega-eng.com	—	—	10 Sep 2026
amorsaude.com.br	—	—	10 Sep 2026
amorsaude.com.br amorsaude.com.br	Healthcare	BR	9 Sep 2026
fdcputman.nl	—	—	8 Sep 2026
contreras.com.ar	—	—	8 Sep 2026

All 370 Lockbit5 victims, searchable

Full victim list with claim posts, domains, timing and exports, plus the negotiation chats and leak-site screenshots VULONE archives for this crew.

Start free Sign in

Tactics, techniques and procedures

ATT&CK technique mapping for Lockbit5 is in progress. Victimology, infrastructure status and leak-site tracking are live above.

Indicators, detections and the full playbook

Hashes, C2 addresses, onion services, Sigma and YARA detections per technique, and the negotiation transcripts are available to signed-in analysts.

See full IOCs

Frequently asked

Is Lockbit5 ransomware still active?

Lockbit5 is tracked as active. The most recent leak-site claim VULONE recorded is dated 14 September 2026. 35 victims were claimed in the last 30 days.

How many victims has Lockbit5 claimed?

VULONE has recorded 370 leak-site victim claims attributed to Lockbit5 since December 2025, across 68 countries and 14 sectors.

Which industries does Lockbit5 target?

The sectors most often named on the Lockbit5 leak site are Professional Services, Manufacturing, Technology.

Which countries are most affected by Lockbit5?

Most Lockbit5 victims recorded by VULONE are located in United States, Brazil, Italy.

Where does VULONE get Lockbit5 victim data?

Claims are collected continuously from the group's own leak sites and cross-checked with ransomware.live and RansomLook. A claim is the group's assertion, not a confirmed breach.

Other ransomware groups

Victim claims are collected from leak sites and enrichment partners (ransomware.live, RansomLook) and represent the group's own assertions, not confirmed breaches. Profile last updated 16 September 2026. Questions or corrections: [email protected].