LOCKBIT5 Ransomware Gang: 4 New Victims Posted Across 4 Countries — Sector Targeting Analysis & Detection Rules

Classification: TLP:CLEAR | Report Date: 2026-09-13 | Analyst: Security Arsenal Threat Intelligence | Source: ransomware.live .onion leak site monitoring

Executive Summary

Security Arsenal's dark web monitoring of LOCKBIT5's .onion leak infrastructure confirms 4 new victim postings between 2026-09-08 and 2026-09-10, spanning Germany, Brazil, the Netherlands, and Argentina. The victim mix — Professional Services, Healthcare, and SMB-tier organizations — is consistent with LOCKBIT5's opportunistic, volume-driven affiliate model rather than a targeted sector campaign. Of particular concern: five CVEs currently on CISA's Known Exploited Vulnerabilities catalog with confirmed ransomware use align with LOCKBIT5's historical initial access tradecraft, led by CVE-2026-59310 (VMware vCenter path traversal) and CVE-2026-20316 (Cisco FMC hard-coded password).

Organizations operating VMware vCenter, Cisco FMC, Check Point gateways, or ConnectWise ScreenConnect should treat this as an active exposure window and prioritize patching and detection deployment immediately.

Threat Actor Profile — LOCKBIT5

Aliases / Lineage: LOCKBIT5 is the fifth major iteration of the LockBit ransomware brand (successor to LockBit 2.0/3.0 "Black" and the post-Operation Cronos LockBit 4.0 rebuild). Following the 2024 law enforcement disruption, the brand was resurrected by surviving core operators and rebranded affiliates. The "5" designation reflects the current builder/encryptor version advertised on their leak site and affiliate panels.

Operating Model: Ransomware-as-a-Service (RaaS). LOCKBIT5 maintains a core development and infrastructure team while outsourcing intrusions to affiliates under a revenue split (historically ~80/20 in the affiliate's favor). This means victim selection is decentralized — the group does not choose victims; affiliates do, which explains the diffuse sector and geographic spread observed in this campaign.

Ransom Demands: Demand scales with victim revenue, typically ranging from $50K for SMBs to $5M+ for mid-market enterprises, with a 7-14 day negotiation window before full data publication. LOCKBIT5 leak sites historically apply countdown timers with escalating partial data leaks.

Initial Access Methods (historical and current):

• Edge device / VPN exploitation — primary vector; heavy abuse of perimeter appliances (Fortinet, Cisco, Check Point, Ivanti) and now VMware vCenter
• RDP brute force / purchased RDP access from initial access brokers (IABs)
• Phishing with macro-enabled documents and malicious loaders (historically paired with SocGholish, Cobalt Strike)
• Remote monitoring & management (RMM) abuse — ConnectWise ScreenConnect exploitation (CVE-2024-1708 lineage) and legitimate RMM tools deployed for persistence

Extortion Model: Double extortion — data theft precedes encryption; leak site publication is the leverage. LOCKBIT5 affiliates exfiltrate to attacker-controlled cloud storage (MEGA, Rclone to S3-compatible endpoints) before detonation.

Dwell Time: Median dwell time observed across LockBit-lineage intrusions is 3-11 days from initial access to encryption, with data staging typically occurring in the final 48-72 hours. Fast-moving affiliates have demonstrated sub-24-hour ransomware deployment when using exploited edge devices with pre-staged tooling.

Current Campaign Analysis

Victim Postings (2026-09-08 → 2026-09-10)

Sector Targeting

• Professional Services / Engineering (DE): Engineering firms hold CAD files, client IP, and project data with high extortion value and historically weak segmentation between OT-adjacent and corporate networks.
• Healthcare (BR): Consistent with LockBit-lineage targeting of Brazilian healthcare — high-pressure extortion due to patient data sensitivity and operational urgency. Note: even organizations with "do not attack healthcare" nominal policies see affiliate violations under RaaS models.
• SMB-tier (NL, AR): Both fdcputman.nl and contreras.com.ar fit the profile of small-to-mid organizations — characteristic of opportunistic edge-device exploitation rather than deliberate selection.

Geographic Concentration

No single-country concentration: DE, BR, NL, AR across four postings in 72 hours. This scatter pattern is a signature of automated or IAB-fed access — affiliates burning purchased access or mass-exploiting vulnerable edge devices regardless of geography. Brazil remains a consistent LockBit-lineage hotspot.

Victim Profile

Estimated revenue range across this victim set: $2M–$50M annual revenue (SMB to lower mid-market). No enterprise-scale victims in this batch — consistent with affiliates prioritizing fast, low-resistance intrusions over big-game hunting during the current campaign phase.

Posting Frequency / Escalation

4 postings in 5 days is moderate-but-steady tempo. The 2026-09-08 double-posting (NL + AR same day) suggests either batch-processing of completed extortion failures or a single affiliate clearing multiple stalled negotiations simultaneously. Watch for escalation: historically, a burst of SMB postings precedes a marquee mid-market victim drop used for publicity.

CVE Correlation — Likely Initial Access Vectors

The following KEV-listed vulnerabilities (all confirmed ransomware-associated) map directly to LOCKBIT5 affiliate tradecraft:

• CVE-2026-59310 — VMware vCenter Path Traversal (KEV 2026-08-18): Highest-priority concern. vCenter compromise gives attackers hypervisor-level control — enabling mass VM encryption, the single most destructive LockBit technique. If you run vCenter and have not patched, assume exposure.
• CVE-2026-20316 — Cisco FMC Hard-coded Password (KEV 2026-07-29): Firewall management plane compromise enables policy manipulation, VPN credential harvesting, and persistent network access.
• CVE-2026-50751 — Check Point Security Gateway Improper Authentication (IKEv1) (KEV 2026-06-08): VPN gateway takeover — classic LockBit initial access pattern.
• CVE-2026-48027 — Nx Console Embedded Malicious Code (KEV 2026-05-27): Supply chain vector targeting developer workstations — relevant to the engineering/professional services victim profile in this batch.
• CVE-2024-1708 — ConnectWise ScreenConnect Path Traversal (KEV 2026-04-28): RMM exploitation for remote code execution — both an access vector and a persistence/lateral movement tool.

Assessment (moderate confidence): The DE engineering firm and NL/AR SMBs most plausibly entered via exploited edge appliances or RMM tooling. The Brazilian healthcare victim's profile is consistent with either VPN exploitation or IAB-sold RDP access.

Detection Engineering

SIGMA Rules

---
title: LOCKBIT5 - Suspicious vCenter/Edge Appliance Post-Exploitation Process Execution
id: 9f3a1c2e-7b4d-4e1a-9c5f-lb5vcenter001
status: experimental
description: Detects suspicious child processes spawned from VMware vCenter (vpxd), web servers, or VPN/firewall management processes consistent with LOCKBIT5 edge-device exploitation follow-on activity (CVE-2026-59310, CVE-2026-20316, CVE-2026-50751).
author: Security Arsenal Threat Intelligence
date: 2026/09/13
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\vpxd.exe'
      - '\tomcat.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\w3wp.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\rundll32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate vCenter update workflows (rare; correlate with change windows)
level: high
tags:
  - attack.initial_access
  - attack.t1190
  - attack.t1059
---
title: LOCKBIT5 - Pre-Encryption Staging - Shadow Copy Deletion and Backup Inhibition
id: 8e2b0d1f-6c3a-4d2b-8b4e-lb5staging002
status: experimental
description: Detects Volume Shadow Copy deletion, boot configuration tampering, and backup catalog deletion commands characteristic of LOCKBIT5 pre-encryption staging.
author: Security Arsenal Threat Intelligence
date: 2026/09/13
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    CommandLine|contains:
      - 'vssadmin delete shadows'
      - 'vssadmin Delete Shadows'
      - 'wmic shadowcopy delete'
      - 'Get-WmiObject Win32_Shadowcopy'
  selection_bcd:
    CommandLine|contains:
      - 'bcdedit'
      - 'recoveryenabled no'
      - 'ignoreallfailures'
  selection_wbadmin:
    CommandLine|contains:
      - 'wbadmin delete catalog'
      - 'wbadmin delete backup'
  condition: 1 of selection_*
falsepositives:
  - Backup administrators performing legitimate catalog maintenance (whitelist service accounts)
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.defense_evasion
---
title: LOCKBIT5 - Lateral Movement and Exfiltration Toolset - PsExec WMI Rclone
id: 7d1c9e0a-5b2f-4c1a-7a3d-lb5latmov003
status: experimental
description: Detects PsExec-style service execution, WMI remote process creation, and Rclone/cloud exfiltration tooling associated with LOCKBIT5 lateral movement and double-extortion data theft.
author: Security Arsenal Threat Intelligence
date: 2026/09/13
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  selection_psexec:
    Image|endswith:
      - '\PSEXESVC.exe'
      - '\psexec.exe'
    CommandLine|contains: '-accepteula'
  selection_wmi_remote:
    ParentImage|endswith: '\WmiPrvSE.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\rundll32.exe'
  selection_rclone:
    Image|endswith:
      - '\rclone.exe'
    CommandLine|contains:
      - 'copy'
      - 'sync'
      - 'mega'
      - 's3'
      - 'sftp'
  condition: 1 of selection_*
falsepositives:
  - Legitimate admin PsExec usage; restrict expected admin hosts via allowlist
  - Enterprise Rclone deployments for backup (rare; verify destination endpoints)
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1047
  - attack.exfiltration
  - attack.t1567.002

KQL — Microsoft Sentinel Hunt Query

Hunt for LOCKBIT5 pre-ransomware staging: suspicious admin-tool lateral movement chains followed by data staging indicators within a 7-day window.

// LOCKBIT5 Pre-Ransomware Staging Hunt — lateral movement + exfil + shadow copy tampering
// Window: last 7 days | Focus: PsExec/WMI chains, Rclone exfil, VSS deletion
let Lookback = 7d;
let SuspiciousStaging = DeviceProcessEvents
| where TimeGenerated >= ago(Lookback)
| where ProcessCommandLine has_any (
    "vssadmin delete shadows",
    "wmic shadowcopy delete",
    "bcdedit",
    "wbadmin delete catalog",
    "recoveryenabled no"
  )
| project StagingTime=TimeGenerated, DeviceName, AccountName,
          StagingCommand=ProcessCommandLine, StagingProcess=FileName;
let LateralMovement = DeviceProcessEvents
| where TimeGenerated >= ago(Lookback)
| where (FileName =~ "PSEXESVC.exe")
   or (InitiatingProcessFileName =~ "WmiPrvSE.exe" and FileName in~ ("cmd.exe","powershell.exe","rundll32.exe"))
   or (FileName =~ "rclone.exe" and ProcessCommandLine has_any ("copy","sync","mega","s3:"))
| project LatMoveTime=TimeGenerated, DeviceName, AccountName,
          LatMoveTool=FileName, LatMoveCommand=ProcessCommandLine;
let RDPBruteForce = DeviceLogonEvents
| where TimeGenerated >= ago(Lookback)
| where LogonType == "RemoteInteractive"
| summarize FailedAttempts = countif(ActionType == "LogonFailed"),
            SuccessAfter = countif(ActionType == "LogonSuccess")
  by DeviceName, RemoteIP, bin(TimeGenerated, 1h)
| where FailedAttempts >= 10 and SuccessAfter >= 1
| project DeviceName, RemoteIP, FailedAttempts, TimeGenerated;
LateralMovement
| join kind=inner SuspiciousStaging on DeviceName
| extend TimeDeltaMinutes = datetime_diff("minute", StagingTime, LatMoveTime)
| where TimeDeltaMinutes between (0 .. 2880)  // staging within 48h of lateral movement
| join kind=leftouter RDPBruteForce on DeviceName
| project DeviceName, AccountName, LatMoveTool, LatMoveCommand,
          StagingCommand, LatMoveTime, StagingTime, TimeDeltaMinutes, RemoteIP
| order by LatMoveTime asc;

Interpretation: Any row returned is a critical-priority investigation. A lateral movement tool followed by VSS/backup tampering within 48 hours is the terminal phase of the LOCKBIT5 playbook — encryption typically follows within hours.

PowerShell — Rapid Exposure & Staging Audit

Run on domain controllers and critical servers to identify exposed RDP, recent persistence mechanisms, and shadow copy tampering.

# LOCKBIT5 Rapid Response Audit — run elevated on DCs, file servers, hypervisor hosts
# Checks: exposed RDP, scheduled tasks (7d), VSS state, suspicious services, RMM tools
$Report = @{}; $Cutoff = (Get-Date).AddDays(-7)

Write-Host "`n=== [1] RDP Exposure Check ===" -ForegroundColor Cyan
$rdpEnabled = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server').fDenyTSConnections -eq 0
$nla = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -ErrorAction SilentlyContinue).UserAuthentication
$Report.RDP = [PSCustomObject]@{ Enabled=$rdpEnabled; NLA=($nla -eq 1); Port=(Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp').PortNumber }
$Report.RDP | Format-List
if ($rdpEnabled -and $nla -ne 1) { Write-Host "[!] RDP ENABLED WITHOUT NLA — brute-force exposure" -ForegroundColor Red }

Write-Host "`n=== [2] Scheduled Tasks Created/Modified Last 7 Days ===" -ForegroundColor Cyan
Get-ScheduledTask | Where-Object { $_.Date -ge $Cutoff -and $_.TaskPath -notlike '\Microsoft*' } |
  Select-Object TaskName, TaskPath, Date, State | Format-Table -AutoSize

Write-Host "`n=== [3] Suspicious Services (PsExec-style / random names) ===" -ForegroundColor Cyan
Get-CimInstance Win32_Service | Where-Object {
  $_.PathName -match 'PSEXESVC|ADMIN\$|\\Temp\\|\\AppData\\.*\.exe' -or
  ($_.Name -match '^[a-zA-Z0-9]{7,8}$' -and $_.PathName -match '\.exe')
} | Select-Object Name, DisplayName, PathName, State | Format-List

Write-Host "`n=== [4] Volume Shadow Copy Status ===" -ForegroundColor Cyan
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $shadows) { Write-Host "[!!!] NO SHADOW COPIES FOUND — possible vssadmin deletion (T1490)" -ForegroundColor Red }
else { $shadows | Select-Object DeviceObject, InstallDate, VolumeName | Format-Table -AutoSize }

Write-Host "`n=== [5] RMM / Exfil Tool Presence ===" -ForegroundColor Cyan
$rmm = @('rclone','screenconnect','anydesk','teamviewer','ammyy','splashtop','AteraAgent')
Get-CimInstance Win32_Process | Where-Object { $n=$_.Name.ToLower(); $rmm | Where-Object { $n -like "*$_*" } } |
  Select-Object Name, ProcessId, CommandLine, CreationDate | Format-List

Write-Host "`n=== [6] Recent Local Admin Group Changes (7d) ===" -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4732; StartTime=$Cutoff} -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match 'Administrators' } | Select-Object TimeCreated, Message -First 20 | Format-List

Write-Host "`nAudit complete. Investigate ANY hits in sections 2-5 immediately." -ForegroundColor Yellow

Incident Response Priorities

T-Minus Detection Checklist — Before Encryption Fires

LOCKBIT5's detonation phase is preceded by a detectable staging window. Alert on and investigate:

1. vssadmin / bcdedit / wbadmin execution on servers (T1490) — highest-fidelity pre-encryption signal
2. Mass file enumeration — abnormal read volumes across file shares from a single host
3. Rclone/MEGA/S3 outbound transfers — any large sustained egress to consumer cloud storage
4. PsExec service creation (Event 7045) or WmiPrvSE-spawned shells on multiple hosts in sequence
5. New scheduled tasks pushing executables to remote hosts (batch deployment of the encryptor)
6. Group Policy modification on domain controllers — LockBit-lineage groups historically distribute encryptors via GPO
7. EDR/AV tampering — service stops, driver kills, or Set-MpPreference exclusions appearing fleet-wide
8. vCenter anomalies — unexpected vpxd child processes, new admin accounts, or VM snapshot/deletion activity (CVE-2026-59310 post-exploitation)

Critical Assets This Gang Prioritizes for Exfiltration

• File servers / NAS — bulk document theft (contracts, financials, HR)
• Email archives (PST/OST exports, Exchange mailboxes)
• Databases — customer/patient records; healthcare victims face PII/PHI leak pressure
• Engineering/IP repositories — CAD, source code, design files (directly relevant to the alphaomega-eng.com victim profile)
• Backup infrastructure — Veeam/backup catalogs are deleted or encrypted first to remove recovery leverage
• Domain controllers — NTDS.dit theft for credential harvesting and ransom valuation

Containment Actions — Ordered by Urgency

1. Isolate at the network layer — VLAN- quarantine affected hosts; do NOT power off (preserve memory for forensics) unless encryption is actively spreading
2. Disable compromised accounts — force reset of any account observed in lateral movement; revoke sessions/tokens
3. Block egress to consumer cloud storage (MEGA, unapproved S3 endpoints, SFTP to unknown IPs) at the proxy/firewall
4. Protect backups immediately — take backup infrastructure offline or air-gap; verify immutability locks
5. Kill PsExec/WMI lateral channels — restrict admin shares, block remote service creation via firewall rules
6. Patch/vIsolate edge devices — vCenter, Cisco FMC, Check Point gateways, ScreenConnect instances
7. Engage IR retainer before ransom note discovery — dwell time compression means hours matter
8. Preserve evidence — memory captures, VPN/edge appliance logs, vCenter event logs before any remediation wipes them

Hardening Recommendations

Immediate (24 Hours)

• Patch or mitigate all five KEV CVEs: CVE-2026-59310 (vCenter), CVE-2026-20316 (Cisco FMC), CVE-2026-50751 (Check Point), CVE-2026-48027 (Nx Console — remove/replace compromised versions), CVE-2024-1708 (ScreenConnect — upgrade or disable)
• Remove vCenter and firewall management interfaces from any internet-reachable path — management planes must be behind jump hosts with MFA
• Enforce NLA + MFA on all RDP; disable internet-facing RDP entirely
• Deploy the three Sigma rules above and run the KQL hunt across the last 7 days of telemetry
• Block PsExec remote service creation for non-admin workstation ranges; alert on all 7045 events from non-approved sources
• Verify shadow copies exist on all file servers (vssadmin list shadows) and alert on deletion
• Block Rclone/MEGA egress at the perimeter unless explicitly business-required
• Run the PowerShell audit script on DCs, file servers, and hypervisor hosts

Short-Term (2 Weeks)

• Segment hypervisor management: vCenter/ESXi on isolated management VLANs with strict ACLs; no workstation-to-hypervisor-plane access
• Immutable, offline backups: 3-2-1 architecture with at least one air-gapped or object-lock (WORM) copy; test restoration this week, not during an incident
• Tiered administration: eliminate standing Domain Admin usage; deploy PAWs and just-in-time elevation to break credential-theft lateral movement
• Deploy application control (WDAC/AppLocker) blocking execution from user-writable paths (AppData, Temp) — kills most LockBit encryptor deployment chains
• SMB signing + disable SMBv1; restrict ADMIN$ share access to admin hosts only
• Email hardening: block macro-enabled Office documents from external senders; detonate attachments in sandbox
• RMM governance: maintain an approved-RMM allowlist and alert on any other remote access tool installation
• Honey credentials and decoy file shares to catch enumeration during the staging window
• Tabletop a LockBit-scenario IR exercise with the T-minus checklist above — validate you can detect staging before detonation

Analyst Assessment

LOCKBIT5's current tempo — 4 victims in 5 days across 4 countries with no sector discipline — indicates a mature affiliate ecosystem executing opportunistic, access-broker-fed intrusions rather than a coordinated campaign. The real enterprise risk is not this specific victim set; it is the convergence of five actively exploited edge-device CVEs with a RaaS operation optimized for fast, automated monetization. Organizations running unpatched vCenter are in the highest-risk posture possible: hypervisor-level compromise collapses recovery options entirely. Patch the edge, watch for staging, protect the backups.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub