LOCKBIT5 Ransomware Gang: 4 New Victims Posted to Dark Web Leak Site — Sector Targeting Analysis & Detection Rules

Classification: TLP:CLEAR | Published: 2026-09-08 | Source: ransomware.live dark web leak site monitoring

Security Arsenal's dark web collection infrastructure observed four new victim postings on LOCKBIT5's .onion leak site between 2026-09-04 and 2026-09-07. The latest iteration of the LockBit brand remains operationally active following the group's repeated rebranding after law enforcement disruption (Operation Cronos), and continues to run one of the most prolific Ransomware-as-a-Service ecosystems in the criminal underground.

1. Threat Actor Profile — LOCKBIT5

LOCKBIT5 inherits the affiliate-heavy structure of its predecessors, meaning TTP variance is high — affiliates bring their own tooling (Cobalt Strike, SystemBC, Metasploit, AnyDesk/ScreenConnect persistence) on top of the shared locker. Detection engineering must target the common denominators: edge-device exploitation, lateral movement via SMB/WMI/PsExec, data staging to Rclone/MEGA/FTP, and shadow copy deletion.

2. Current Campaign Analysis

Victims Posted (2026-09-04 → 2026-09-07)

Sector Targeting

• Healthcare (2/4, 50%) — consistent with the group's historical willingness to hit small-to-mid healthcare providers despite public statements to the contrary. A Dutch GP practice and a German pharma-adjacent firm in the same 24-hour window suggests a coordinated affiliate wave against European healthcare.
• Professional Services (Legal) — law firms are high-value exfiltration targets due to privileged client data, which maximizes extortion leverage.
• Manufacturing — classic LockBit vertical; operational technology downtime pressure forces faster ransom decisions.

Geographic Concentration

No single-country concentration: ZA, NL, DE, US. The pattern indicates opportunistic, exposure-driven targeting rather than a geographically focused campaign — affiliates are hitting whatever vulnerable edge infrastructure they can find and monetize.

Victim Profile

All four victims are small-to-midsize organizations (estimated 20–250 employees, ~$5M–$50M revenue). This fits the post-Operation-Cronos LockBit pattern: enterprise-scale intrusions have declined, and affiliates now prefer SMBs with weaker SOC coverage, unpatched edge devices, and limited IR retainers.

Posting Frequency & Escalation

Three victims published on a single day (2026-09-04) followed by one on 2026-09-07 indicates a batch publication pattern — the leak site operator typically posts victims in waves after negotiation deadlines expire. A frequency of ~4 postings per 100-site sample window confirms LOCKBIT5 is operating at reduced but steady tempo compared to LockBit 3.0's peak (20+ victims/week). Watch for escalation if a large affiliate cell onboards.

CVE Correlation (Initial Access Vectors)

The CISA KEV entries confirmed for ransomware use map directly onto this gang's playbook:

• CVE-2026-50751 (Check Point Security Gateway, improper authentication in IKEv1) — the single most likely initial access vector in this campaign. Edge VPN gateway auth bypass → credential theft → internal pivot is textbook LockBit affiliate tradecraft.
• CVE-2024-1708 (ConnectWise ScreenConnect path traversal → RCE) — RMM abuse for both initial access and persistence; ScreenConnect has been a LockBit affiliate staple since early 2024.
• CVE-2025-60710 (Windows link following → privilege escalation) — likely used post-compromise for SYSTEM-level privilege before defense evasion.
• CVE-2023-21529 (Exchange deserialization) — authenticated RCE against on-prem Exchange, relevant to the legal/healthcare victims running legacy mail infrastructure.
• CVE-2026-48027 (Nx Console embedded malicious code) — supply chain compromise of developer tooling; consistent with LockBit affiliates' opportunistic use of poisoned packages to harvest developer credentials and CI/CD secrets.

Assessment: Organizations running Check Point gateways, on-prem Exchange, or ConnectWise ScreenConnect in the ZA/NL/DE/US healthcare and professional services space should treat this as an active, targeted threat window.

3. Detection Engineering

Sigma Rules

---
title: LOCKBIT5 - Edge VPN Auth Bypass Followed by Internal RDP Pivot
id: 9f3c1a2e-7b4d-4e1a-a5c6-lockbit5vpn01
status: experimental
description: Detects successful VPN logon from unusual geolocation/ASN followed within 1h by RDP logon to internal assets - consistent with LockBit affiliate exploitation of CVE-2026-50751 (Check Point IKEv1 auth bypass)
author: Security Arsenal Threat Intelligence
date: 2026/09/08
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
  category: authentication
  product: windows
detection:
  selection_rdp:
    EventID: 4624
    LogonType: 10
  filter_noise:
    IpAddress|startswith:
      - '10.'
      - '192.168.'
  condition: selection_rdp and not filter_noise
falsepositives:
  - Legitimate remote administration via RDP from VPN pools (tune with known VPN egress ranges)
level: high
tags:
  - attack.initial_access
  - attack.t1133
  - attack.t1021.001
---
title: LOCKBIT5 - Pre-Encryption Defense Evasion and Shadow Copy Deletion
id: 2b8d4f1c-3a9e-4c7b-b2d1-lockbit5vss02
status: tested
description: Detects vssadmin/wmic/bcdedit execution consistent with LockBit pre-encryption shadow copy deletion and boot recovery tampering
date: 2026/09/08
author: Security Arsenal Threat Intelligence
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\bcdedit.exe'
      - '\diskshadow.exe'
  selection_cmd:
    CommandLine|contains:
      - 'delete shadows'
      - 'resize shadowstorage'
      - 'shadowcopy delete'
      - 'recoveryenabled no'
      - 'bootstatuspolicy ignoreallfailures'
  condition: selection_img and selection_cmd
falsepositives:
  - Rare; backup administrators may legitimately resize shadow storage (whitelist by user/host)
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.defense_evasion
---
title: LOCKBIT5 - Data Staging and Exfiltration via Rclone or MEGA Utilities
id: 7e1a5c9d-6f2b-4a8e-c3d4-lockbit5exf03
status: experimental
description: Detects execution of Rclone/MEGAcmd/FileZilla CLI commonly used by LockBit affiliates to stage and exfiltrate victim data before encryption detonation
date: 2026/09/08
author: Security Arsenal Threat Intelligence
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\rclone.exe'
      - '\mega-cmd.exe'
      - '\MEGAcmdShell.exe'
      - '\filezilla.exe'
      - '\winscp.com'
  selection_args:
    CommandLine|contains:
      - 'copy'
      - 'sync'
      - 'move'
      - '--transfers'
  condition: all of selection*
falsepositives:
  - Legitimate cloud sync tooling; alert on any execution outside approved backup service accounts
level: high
tags:
  - attack.exfiltration
  - attack.t1567.002
  - attack.collection

KQL — Microsoft Sentinel Hunt Query

// LOCKBIT5 Pre-Ransomware Staging Hunt: lateral movement + exfil staging in 7-day window
// Looks for PsExec-style service installs, WMI remote execution, and suspicious archive creation
let Lookback = 7d;
let SuspiciousHosts =
DeviceProcessEvents
| where TimeStamp >= ago(Lookback)
| where ProcessCommandLine has_any ("vssadmin delete shadows", "bcdedit", "recoveryenabled no")
    or FileName in~ ("rclone.exe", "mega-cmd.exe")
| summarize by DeviceName;
union
(DeviceProcessEvents
| where TimeStamp >= ago(Lookback)
| where FileName =~ "wmic.exe" and ProcessCommandLine has "process call create"
| project TimeStamp, DeviceName, LateralMethod="WMI_RemoteExec", InitiatingProcess=InitiatingProcessFileName, ProcessCommandLine, AccountName),
(DeviceEvents
| where TimeStamp >= ago(Lookback)
| where ActionType == "ServiceInstalled"
| extend Parsed = parse_json(AdditionalFields)
| where tostring(Parsed.ServiceName) startswith "PSEXESVC" or tostring(Parsed.ServiceName) has_any ("paexec", "remcom")
| project TimeStamp, DeviceName, LateralMethod="PsExec_ServiceInstall", InitiatingProcess=tostring(Parsed.ServiceName), AccountName=""),
(DeviceProcessEvents
| where TimeStamp >= ago(Lookback)
| where FileName in~ ("7z.exe", "rar.exe", "tar.exe")
| where ProcessCommandLine has_any (" -p", "a ", "\\Users\\", "\\Shares\\")
| project TimeStamp, DeviceName, LateralMethod="Archive_Staging", InitiatingProcess=InitiatingProcessFileName, ProcessCommandLine, AccountName)
| where DeviceName in (SuspiciousHosts)
| sort by DeviceName, TimeStamp asc

PowerShell — Rapid Response Script

# LOCKBIT5 Rapid Triage Script - Run on suspected pre-detonation hosts
# Checks: exposed RDP, new scheduled tasks (7d), shadow copy tampering, suspicious persistence
Write-Host "=== Security Arsenal LOCKBIT5 Rapid Triage ===" -ForegroundColor Cyan

# 1. Is RDP exposed/enabled?
$rdp = Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue
Write-Host "[+] RDP Enabled (0=enabled): $($rdp.fDenyTSConnections)"
Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue | ForEach-Object { Write-Host "[!] RDP LISTENING on $($_.LocalAddress):3389" -ForegroundColor Red }

# 2. Scheduled tasks created in last 7 days (LockBit affiliate persistence/lateral movement)
Write-Host "`n[+] Scheduled tasks created/modified in last 7 days:"
Get-ScheduledTask | ForEach-Object {
    $info = $_ | Get-ScheduledTaskInfo -ErrorAction SilentlyContinue
    if ($_.Date -and ([datetime]$_.Date) -gt (Get-Date).AddDays(-7)) {
        Write-Host "    $($_.TaskPath)$($_.TaskName)  -- $($_.Date)" -ForegroundColor Yellow
    }
}

# 3. Volume Shadow Copy status (should be non-zero on servers)
Write-Host "`n[+] Shadow copies present:"
$shadows = vssadmin list shadows 2>$null
if ($shadows -match 'No items found') { Write-Host "[!] NO SHADOW COPIES - possible vssadmin deletion (pre-encryption indicator)" -ForegroundColor Red }
else { $shadows | Select-String 'creation time' | ForEach-Object { Write-Host "    $_" } }

# 4. Recent suspicious binaries in staging directories
Write-Host "`n[+] Suspicious staging artifacts (rclone/7z/mega) modified in last 7 days:"
Get-ChildItem -Path 'C:\Users','C:\ProgramData','C:\Windows\Temp' -Recurse -Include 'rclone.exe','7z.exe','mega*.exe','psexec.exe' -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) } |
    ForEach-Object { Write-Host "    $($_.FullName)  -- $($_.LastWriteTime)" -ForegroundColor Yellow }

# 5. Failed logon spike check (RDP brute force / credential stuffing)
Write-Host "`n[+] Failed logons (4625) last 24h:"
$fails = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddDays(-1)} -ErrorAction SilentlyContinue
Write-Host "    Count: $($fails.Count)" -ForegroundColor $(if($fails.Count -gt 500){'Red'}else{'Green'})
Write-Host "=== Triage Complete ===" -ForegroundColor Cyan

4. Incident Response Priorities — LOCKBIT5 Playbook

T-Minus Detection Checklist (Before Encryption Fires)

• Edge device auth anomalies — new local admin accounts on Check Point/firewall/VPN appliances; logins from unusual ASNs or TOR exit nodes (CVE-2026-50751 exploitation aftermath)
• New RMM installations — AnyDesk, ScreenConnect, Splashtop, or Atera appearing on hosts where they were never sanctioned
• Batch credential access — ntds.dit exfiltration, LSASS dumps (procdump, comsvcs.dll MiniDump), DCSync replication requests
• Data staging directories — large archives (.7z, .rar) aggregating in C:\ProgramData, user profile roots, or staging shares; multi-GB outbound flows to MEGA, Temp.sh, or unknown cloud endpoints
• GPO changes — new or modified Group Policy objects referencing scripts or software pushes (LockBit's self-spreading GPO deployment technique)
• Defense evasion cascade — AV/EDR tamper events, bcdedit recovery tampering, shadow copy deletion, clearing of Event Logs (1102)
• Cobalt Strike indicators — named pipes (\\postex_*, \\msagent_*), default Malleable C2 JA3 fingerprints, beaconing at fixed jittered intervals

Critical Assets Historically Prioritized for Exfiltration

1. Legal/client privileged data — matter files, contracts, litigation documents (see the ZA law firm victim)
2. Patient records & PII/PHI — EHR databases, billing records (healthcare victims are exfiltrated even when encryption fails)
3. Finance data — payroll, banking details, tax records
4. IP and engineering — CAD files, formulas, manufacturing process documentation
5. Executive communications — mailbox exports from on-prem Exchange (CVE-2023-21529 relevance)

Containment Actions — Ordered by Urgency

1. Isolate the edge — disable/revoke all VPN sessions, rotate all credentials that traversed the VPN (assume full credential theft if CVE-2026-50751 was exploited), block C2 egress at the firewall
2. Kill RMM persistence — uninstall/block unsanctioned remote access tools; hunt for services and run keys they created
3. Segment immediately — isolate affected VLANs; disable SMBv1; block lateral movement ports (445, 135, 5985/5986) between workstation segments
4. Disable compromised accounts — especially any account with recent interactive logons to servers it doesn't normally touch
5. Preserve volatile evidence — memory capture on suspected staging hosts before reboot; do NOT rebuild until forensic images are taken
6. Protect backups — take backup infrastructure offline from domain authentication; verify immutable/offline copies exist before they become the next target
7. Engage IR retainer + legal counsel — notification obligations (GDPR for NL/DE victims, state breach laws for US) start on discovery, not confirmation

5. Hardening Recommendations

Immediate (24 Hours)

• Patch Check Point Security Gateways for CVE-2026-50751 — if patching is not possible within 24h, disable IKEv1 VPN or place the gateway behind compensating controls; audit VPN logs for the last 90 days for auth anomalies
• Patch ConnectWise ScreenConnect (CVE-2024-1708) and audit for rogue sessions/extensions; block ScreenConnect at the proxy if not business-critical
• Patch on-prem Exchange (CVE-2023-21529) and restrict EWS/remote PowerShell exposure
• Patch Windows link-following privilege escalation (CVE-2025-60710)
• Block known exfil channels — deny rclone/MEGA/Temp.sh egress at the proxy; alert on unsigned archive utilities executing outside admin tool directories
• Enforce phishing-resistant MFA on all remote access — hardware keys or certificate auth on VPN, no SMS/TOTP-only for privileged accounts
• Verify shadow copies and offline backups — confirm VSS is healthy and backups are immutable and domain-isolated

Short-Term (2 Weeks)

• Decommission or replace IKEv1-based VPN infrastructure with modern TLS-based ZTNA; the recurring exploitation of VPN appliances by this ecosystem is an architectural problem, not a patching problem
• Deploy an application allowlisting policy blocking rclone, MEGAcmd, PsExec, and unsigned binaries in user-writable paths for non-admin users
• Implement tiered administration — separate workstations/accounts for tier-0 assets (DCs, backup infrastructure) so affiliate credential theft can't reach the crown jewels
• Expand EDR coverage to servers and edge-adjacent jump hosts — the SMB victims in this campaign were almost certainly blind on server telemetry
• Detonation canary files — deploy honey files with alerting on open/rename to catch the encryption phase seconds after it starts
• Tabletop a LockBit-style double-extortion scenario — legal, comms, and exec leadership must decide their leak-site response posture before a countdown timer forces the decision

Analyst Note

LOCKBIT5's current wave is opportunistic but well-tooled. The 50% healthcare share and the legal-services hit both point to exfiltration-leverage-driven victim selection: affiliates are choosing organizations whose stolen data generates maximum regulatory and reputational pain. The defensive return on investment is clear — patch the Check Point and ScreenConnect edge exposure, kill unsanctioned RMM, and instrument shadow copy deletion as a critical-severity alert. Organizations that do those three things remove the majority of this gang's current kill chain.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub