LOCKBIT5: Global Multi-Sector Campaign Exploiting Perimeter Vulnerabilities — Healthcare & Manufacturing Under Siege

---
title: Potential LockBit5 Affiliate Activity - Check Point Gateway Exploitation
id: 49e3f26b-a21b-4465-b9a9-4c6c2e6d72aa
description: Detects potential exploitation of CVE-2026-50751 and subsequent LockBit5 activity
status: experimental
date: 2026/06/20
references:
    - https://securityarsenal.com/threat-intelligence/lockbit5
author: Security Arsenal Threat Intel Team
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2026.50751
    - ransomware.lockbit5
logsource:
    product: firewall
detection:
    selection:
        dest_port: 500
        protocol: udp
    filter_ike:
        action|contains: 'accept'
    condition: selection and not filter_ike
falsepositives:
    - Legitimate IKEv1 traffic
level: high
---
title: LockBit5 Pre-Encryption Data Staging Pattern
id: 3f8d45a2-b5c7-4d9e-a7f3-8c9e1d2f6a8b
description: Detects data exfiltration patterns consistent with LockBit5 affiliate operations
status: experimental
date: 2026/06/20
references:
    - https://securityarsenal.com/threat-intelligence/lockbit5
author: Security Arsenal Threat Intel Team
tags:
    - attack.exfiltration
    - attack.t1041
    - ransomware.lockbit5
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 5140
        ShareName|contains:
            - 'ADMIN$'
            - 'C$'
            - 'IPC$'
    filter_legitimate:
        SubjectUserName|contains:
            - 'ADMIN'
            - 'svc_'
    timeframe: 1h
    condition: selection and not filter_legitimate | count() > 5
falsepositives:
    - Legitimate administrative access
    - Backup operations
level: critical
---
title: LockBit5 WMI Lateral Movement Indicator
id: 7a6c2d9e-8f4b-4a2e-c5d3-1e9f8a7b6c5d
description: Detects WMI execution patterns commonly used by LockBit5 for lateral movement
status: experimental
date: 2026/06/20
references:
    - https://securityarsenal.com/threat-intelligence/lockbit5
author: Security Arsenal Threat Intel Team
tags:
    - attack.lateral_movement
    - attack.t1047
    - ransomware.lockbit5
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4688
        NewProcessName|endswith: '\\wmiprvse.exe'
        CommandLine|contains:
            - 'Create'
            - 'Invoke-CimMethod'
    filter_legitimate:
        SubjectUserName|contains:
            - 'NT AUTHORITY\\SYSTEM'
            - 'NT SERVICE\\'
    condition: selection and not filter_legitimate
falsepositives:
    - Legitimate system administration
level: high

// Hunt for LockBit5 lateral movement and data staging indicators
let Timeframe = 7d;
let CommonAdminTools = dynamic(["powershell.exe", "cmd.exe", "psexec.exe", "wmic.exe"]);
let SuspiciousProcesses = materialize(
    DeviceProcessEvents
    | where Timestamp > ago(Timeframe)
    | where ProcessVersionInfoCompanyName has_any ("Microsoft", "Sysinternals") == false
    | where FileName in~ (CommonAdminTools)
    | where InitiatingProcessAccountName !contains "ADMIN"
    | summarize count(), make_set(ProcessCommandLine, 100) by DeviceName, FileName, InitiatingProcessAccountName
    | where count_ > 3
);
let LargeFileOperations = materialize(
    DeviceFileEvents
    | where Timestamp > ago(Timeframe)
    | where FileSize > 100000000 // Files larger than 100MB
    | where ActionType =~ "FileCreated" or ActionType =~ "FileModified"
    | summarize count(), make_set(FileName, 50), make_set(FolderPath, 20) by DeviceName, InitiatingProcessAccountName
    | where count_ > 10
);
SuspiciousProcesses
| join kind=fullouter LargeFileOperations on DeviceName
| project DeviceName, FileName, count_, ProcessCommandLine_set, InitiatingProcessAccountName, FileOperationsCount = count__1, FileNames_set, FolderPaths_set
| where isnotempty(count_) or isnotempty(FileOperationsCount)
| order by coalesce(count_, 0) desc, coalesce(FileOperationsCount, 0) desc

# LockBit5 Rapid Response Detection Script
# Author: Security Arsenal Threat Intel Team
# Purpose: Detect indicators of LockBit5 activity and potential compromise

Write-Host "Starting LockBit5 Indicator Scan..." -ForegroundColor Cyan

# Check for recently created scheduled tasks (potential persistence mechanism)
Write-Host "\n[+] Checking for recently created scheduled tasks..." -ForegroundColor Yellow
$RecentTasks = Get-ScheduledTask | Where-Object { $_.Date -gt (Get-Date).AddDays(-7) }
if ($RecentTasks) {
    Write-Host "WARNING: Found $($RecentTasks.Count) scheduled tasks created in the last 7 days:" -ForegroundColor Red
    $RecentTasks | Format-List TaskName, Date, Author, Actions
} else {
    Write-Host "No suspicious scheduled tasks found." -ForegroundColor Green
}

# Check for unusual RDP connections
Write-Host "\n[+] Checking for recent RDP connections..." -ForegroundColor Yellow
$RDPEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4624; StartTime=(Get-Date).AddDays(-3)} -ErrorAction SilentlyContinue |
    Where-Object {$_.Message -like '*Logon Type: 10*'} |
    Select-Object TimeCreated, @{n='User';e={$_.Properties[5].Value}}, @{n='IP';e={$_.Properties[18].Value}} |
    Group-Object IP | Where-Object {$_.Count -gt 5}

if ($RDPEvents) {
    Write-Host "WARNING: Found IPs with excessive RDP connections:" -ForegroundColor Red
    $RDPEvents | Format-Table Name, Count -AutoSize
} else {
    Write-Host "No suspicious RDP activity detected." -ForegroundColor Green
}

# Check for deleted or modified Volume Shadow Copies
Write-Host "\n[+] Checking Volume Shadow Copy status..." -ForegroundColor Yellow
try {
    $VSSStatus = vssadmin list shadows /for=c:
    if ($VSSStatus -like "No shadow copies found") {
        Write-Host "WARNING: No shadow copies found on C: drive. This may indicate deletion." -ForegroundColor Red
    } else {
        Write-Host "Shadow copies exist on C: drive." -ForegroundColor Green
    }
} catch {
    Write-Host "Could not check shadow copy status: $_" -ForegroundColor Yellow
}

# Check for processes with suspicious parent-child relationships
Write-Host "\n[+] Checking for suspicious process relationships..." -ForegroundColor Yellow
$SuspiciousParents = @("winword.exe", "excel.exe", "powershell.exe")
$SuspiciousChildren = @("cmd.exe", "powershell.exe", "wscript.exe")

Get-WmiObject Win32_Process | Where-Object {
    $_.ParentProcessId -ne 0 -and 
    $SuspiciousParents -contains (Get-Process -Id $_.ParentProcessId -ErrorAction SilentlyContinue).ProcessName -and 
    $SuspiciousChildren -contains $_.ProcessName
} | ForEach-Object {
    $Parent = Get-Process -Id $_.ParentProcessId -ErrorAction SilentlyContinue
    Write-Host "WARNING: Suspicious process chain detected: $($Parent.ProcessName) -> $($_.ProcessName) (PID: $($_.ProcessId))" -ForegroundColor Red
}

Write-Host "\nScan complete. If any warnings were detected, initiate incident response procedures immediately." -ForegroundColor Cyan