Skip to main content
Darkfield

Operator dossier

lockbit5 is a ransomware operator currently active on public leak sites. Darkfield has indexed 320 public victims claimed by this operator between December 7, 2025 and July 11, 2026. Based on the provided data, LockBit5 appears to be a recently emerged ransomware operation first observed in December 2025, representing what may be a new iteration or rebrand within the LockBit ransomware ecosystem, with primary financial motivations evidenced by their targeting of high-value sectors. Given the LockBit naming convention and the timing of emergence, this group likely operates from Eastern Europe or Russia and may represent either a continuation of previous LockBit operations or a new affiliate group leveraging the established LockBit brand, though specific organizational details remain undocumented by major security agencies. While detailed attack methodologies have not been publicly documented by CISA, FBI, or major security researchers, the group's targeting pattern across 157 victims suggests a broad-spectrum approach focusing on technology, manufacturing, healthcare, and transportation sectors primarily in the United States, Brazil, Germany, Italy, and Mexico. Due to the group's recent emergence in December 2025, there are no publicly documented notable campaigns or major incidents reported by established threat intelligence sources, though the victim count indicates active operations. The group appears to be currently active based on the recent first observation date, though comprehensive analysis from major security agencies has not yet been published given the short timeframe since emergence.

Most-targeted sectors

Most-affected countries

Recent disclosures by lockbit5

Most recent 150 of 320 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for lockbit5 →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Active ransomware operator

← All groups

lockbit5

320 victims indexed · first seen 7 months ago · last activity 4 days ago

320
Victims indexed
#27 of 364 tracked operators
7m
Active period
Dec 2025 → Jul 2026
10
Countries hit
top US · 33

At a glance

Status
active
First seen
7 months ago
Last activity
4 days ago
Primary sector
Not Found · 73 hits

About

Based on the provided data, LockBit5 appears to be a recently emerged ransomware operation first observed in December 2025, representing what may be a new iteration or rebrand within the LockBit ransomware ecosystem, with primary financial motivations evidenced by their targeting of high-value sectors. Given the LockBit naming convention and the timing of emergence, this group likely operates from Eastern Europe or Russia and may represent either a continuation of previous LockBit operations or a new affiliate group leveraging the established LockBit brand, though specific organizational details remain undocumented by major security agencies. While detailed attack methodologies have not been publicly documented by CISA, FBI, or major security researchers, the group's targeting pattern across 157 victims suggests a broad-spectrum approach focusing on technology, manufacturing, healthcare, and transportation sectors primarily in the United States, Brazil, Germany, Italy, and Mexico. Due to the group's recent emergence in December 2025, there are no publicly documented notable campaigns or major incidents reported by established threat intelligence sources, though the victim count indicates active operations. The group appears to be currently active based on the recent first observation date, though comprehensive analysis from major security agencies has not yet been published given the short timeframe since emergence.

References

1 link

External sources curated by the MISP threat-intel community.

Timeline

4 months
2025-12-01T00:00:00+00:00 · 1112026-01-01T00:00:00+00:00 · 82026-02-01T00:00:00+00:00 · 342026-03-01T00:00:00+00:00 · 4
2025-12-01T00:00:00+00:002026-03-01T00:00:00+00:00

Top countries

🇺🇸 United States
33
🇧🇷 Brazil
13
🇩🇪 Germany
8
🇲🇽 Mexico
8
🇮🇹 Italy
8
🇹🇷 Türkiye
6
🇮🇳 India
6
🇫🇷 France
5
United States dossier →Brazil dossier →Germany dossier →Mexico dossier →

Top sectors

Technology
25
Manufacturing
14
Healthcare
8
Transportation/Logistics
6
Financial Services
6
Construction
5
Public Sector
5
Education
4
Technology dossier →Manufacturing dossier →Healthcare dossier →Transportation/Logistics dossier →

MITRE ATT&CK

5 techniques · 4 tactics

Tactics

Initial AccessExecutionDefense EvasionImpact

Techniques

  • T1190Exploit Public-Facing Application
  • T1566Phishing
  • T1059Command and Scripting Interpreter
  • T1027Obfuscated Files or Information
  • T1486Data Encrypted for Impact

Detection · YARA rules

2 rules

  • Lockbit2_Jul21

    YARA rule from ATR/Trellix: ransomware/RANSOM_Lockbit2.yar

    source: ATR/Trellix

  • to

    YARA rule from ATR/Trellix: ransomware/RANSOM_Lockbit2.yar

    source: ATR/Trellix

Recent victims

Loading…

Source

Updated 4 days ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time lockbit5 posts a victim.

Add lockbit5 to your watchlist — Pro pings you within 5 minutes of any new lockbit5 leak-site post, Telegram callout, or affiliate-rebrand inference.