LOCKBIT5 Ransomware Gang: 5 New Victims Posted in 48 Hours — European Campaign Analysis, CVE Exploitation Links & Detection Rules

Classification: TLP:CLEAR | Report Date: 2026-08-17 | Source: Dark web leak site monitoring via ransomware.live | Confidence: High (direct leak site observation)

Executive Summary

LOCKBIT5, the latest iteration of the LockBit ransomware brand, has posted 5 new victims to its dark web leak site within a 48-hour window (2026-08-16), signaling a concentrated European intrusion campaign. All five victims are located in Germany (2), France (2), and Italy (1), spanning Technology, Energy & Utilities, Agriculture and Food Production, and Professional Services sectors. The tight temporal clustering of posts strongly suggests a single intrusion wave or batch detonation — likely sharing a common initial access vector, with CISA KEV-confirmed perimeter vulnerabilities (Check Point, ScreenConnect, Exchange) as leading candidates.

Organizations operating VPN concentrators, remote access tooling, or Exchange infrastructure in the EU should treat this as an active threat requiring immediate patching and hunt operations.

Threat Actor Profile — LOCKBIT5

Analyst Note: LOCKBIT5's post-Cronos resurrection has leaned heavily into perimeter appliance exploitation rather than the phishing-heavy tradecraft of earlier versions — consistent with the KEV entries associated with this campaign window.

Current Campaign Analysis

Victimology (Observed 2026-08-16)

Sector Targeting

• Energy & Utilities (vgrn.de) is the highest-impact hit — utility operators carry OT-adjacency risk and elevated regulatory/political pressure to pay or resolve quietly. Expect this leak to attract regulator attention in Germany.
• Professional Services (2 of 5 victims) — classic LockBit affiliate behavior: law and advisory firms hold concentrated third-party confidential data, maximizing extortion leverage.
• Agriculture/Food Production continues the group's pattern of hitting soft-underbelly supply chain sectors with low security maturity.

Geographic Concentration

100% of this posting batch is EU-based (DE/IT/FR). This is a meaningful deviation from LockBit's historically US-heavy victim mix and suggests either (a) a dedicated European affiliate cell, or (b) exploitation of regionally concentrated infrastructure (e.g., Check Point deployments prevalent in DACH enterprises).

Posting Frequency & Escalation

Five simultaneous posts on a single day following a quiet period indicates batch detonation — multiple affiliates detonating on a coordinated window, or one affiliate working a pipeline of intrusions sourced from a single access broker. Historical LockBit pattern: a burst like this is typically followed by 2–3 weeks of sustained posting as negotiation timers expire. Expect additional EU victims through early September.

CVE Correlation — Probable Initial Access Vectors

The following KEV-listed vulnerabilities overlap directly with LOCKBIT5's known tradecraft and this campaign's timeline:

• CVE-2026-50751 (Check Point Security Gateway — Improper Authentication in IKEv1): The strongest candidate for this campaign. VPN gateway compromise enables credential theft and direct internal access — matching LockBit's post-Cronos perimeter-first doctrine. Patch immediately if IKEv1 is enabled.
• CVE-2024-1708 (ConnectWise ScreenConnect — Path Traversal/RCE): RMM exploitation provides both initial access and a pre-installed legitimate remote access channel for hands-on-keyboard operations. Check for unauthorized ScreenConnect instances.
• CVE-2023-21529 (Exchange Deserialization): Authenticated RCE on Exchange — viable pivot point for the professional services victims running on-prem mail.
• CVE-2025-60710 (Windows Link Following — Privilege Escalation): Post-exploitation elevation tool, not initial access; expect its use between foothold and domain dominance.
• CVE-2026-48027 (Nx Console — Embedded Malicious Code): Supply-chain vector targeting developer environments — plausible entry for the technology sector victim (tecosim.com).

Assessment: The campaign likely chains perimeter exploitation (Check Point/ScreenConnect) → credential harvesting → privilege escalation (CVE-2025-60710) → lateral movement (PsExec/WMI) → staged exfiltration → batch encryption.

Detection Engineering

The following Sigma rules target LOCKBIT5's documented TTPs: VPN/perimeter anomalies, RMM abuse, PsExec/WMI lateral movement, VSS destruction, and pre-encryption data staging.

---
title: LockBit5 Pre-Encryption Volume Shadow Copy Deletion
id: 8f2a1b3c-lb5-2026-0001
status: production
description: Detects vssadmin/wmic/bcdedit execution consistent with LockBit5 pre-encryption shadow copy deletion and boot recovery tampering
author: Security Arsenal Threat Intelligence
date: 2026/08/17
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
level: high
detection:
  selection_img:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\bcdedit.exe'
  selection_vss:
    CommandLine|contains:
      - 'delete shadows'
      - 'resize shadowstorage'
      - 'shadowcopy delete'
  selection_bcd:
    CommandLine|contains:
      - 'recoveryenabled no'
      - 'ignoreallfailures'
  condition: selection_img and (selection_vss or selection_bcd)
falsepositives:
  - Legitimate backup administrators, SCCM operations
fields:
  - ComputerName
  - User
  - CommandLine
  - ParentImage
tags:
  - attack.impact
  - attack.t1490
---
title: LockBit5 Lateral Movement via PsExec Service Installation or WMI Remote Process
id: 8f2a1b3c-lb5-2026-0002
status: production
description: Detects PsExec service creation (7045) and WMI remote process execution patterns used by LockBit5 affiliates for domain-wide ransomware deployment
author: Security Arsenal Threat Intelligence
date: 2026/08/17
references:
  - https://securityarsenal.com/darkside
logsource:
  product: windows
  service: system
level: high
detection:
  selection_psexec:
    EventID: 7045
    ServiceName|contains:
      - 'PSEXESVC'
      - 'PAExec'
  selection_wmi:
    EventID: 7045
    ImagePath|contains:
      - 'WmiPrvSE'
  condition: selection_psexec or selection_wmi
falsepositives:
  - Legitimate administrative tooling; baseline known admin hosts and service accounts
fields:
  - ComputerName
  - ServiceName
  - ImagePath
  - ServiceAccountName
tags:
  - attack.lateral-movement
  - attack.t1021.002
  - attack.t1569.002
---
title: LockBit5 Suspicious RMM Tool Execution or Data Staging via rclone
id: 8f2a1b3c-lb5-2026-0003
status: production
description: Detects unauthorized RMM tool execution (ScreenConnect, AnyDesk) and rclone-based exfiltration staging observed in LockBit5 intrusions prior to encryption
author: Security Arsenal Threat Intelligence
date: 2026/08/17
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
level: high
detection:
  selection_rmm_img:
    Image|endswith:
      - '\ScreenConnect.ClientService.exe'
      - '\AnyDesk.exe'
      - '\rclone.exe'
  selection_rclone_args:
    CommandLine|contains:
      - 'copy '
      - 'sync '
      - 'mega'
      - '--transfers'
  condition: selection_rmm_img and (selection_rclone_args or 1 of selection_unsigned*)
  selection_unsigned_path:
    Image|startswith:
      - 'C:\Users\'
      - 'C:\ProgramData\'
      - 'C:\Windows\Temp\'
falsepositives:
  - Sanctioned IT RMM deployments — maintain an allowlist of approved RMM binaries and paths
fields:
  - ComputerName
  - User
  - Image
  - CommandLine
  - Hashes
tags:
  - attack.command-and-control
  - attack.t1219
  - attack.exfiltration
  - attack.t1567.002

Hunt query for Microsoft Sentinel — correlates pre-ransomware staging indicators (mass file access, suspicious archive creation, new admin tooling, and shadow copy tampering) within a 6-hour window per host:

// LockBit5 Pre-Ransomware Staging Hunt — Sentinel
// Looks for co-occurrence of staging behaviors on the same host within 6h
let Window = 6h;
let Lookback = 14d;
let StagingEvents = union
    (DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where ProcessCommandLine has_any ("delete shadows", "recoveryenabled no", "rclone", "7z.exe a", "rar.exe a", "-mhe=on")
    | project TimeGenerated, DeviceName, AccountName, Indicator=ProcessCommandLine, Type="Process"),
    (DeviceEvents
    | where TimeGenerated > ago(Lookback)
    | where ActionType == "ServiceInstalled"
    | project TimeGenerated, DeviceName, AccountName=InitiatingProcessAccountName, Indicator=AdditionalFields, Type="ServiceInstall");
StagingEvents
| summarize Indicators = make_set(Indicator), Types = make_set(Type), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated)
    by DeviceName, bin(TimeGenerated, Window)
| where array_length(Types) >= 2
| project DeviceName, FirstSeen, LastSeen, Types, Indicators
| join kind=inner (DeviceNetworkEvents
    | where TimeGenerated > ago(Lookback)
    | where RemotePort in (445, 3389, 5985)
    | summarize LateralTargets = dcount(RemoteIP) by DeviceName)
    on DeviceName
| where LateralTargets > 5
| sort by FirstSeen desc;

Rapid-response PowerShell script — audits a host for the highest-signal LockBit5 pre-detonation artifacts in under a minute:

# LockBit5 Rapid Triage — run on suspected compromised hosts (elevated)
# Checks: VSS state, new scheduled tasks (7d), suspicious services, exposed RDP, recent shadow copy events
$out = "C:\Temp\LB5_Triage_$(hostname)_$(Get-Date -Format yyyyMMdd_HHmm).txt"
New-Item -Path C:\Temp -ItemType Directory -Force | Out-Null
"=== LOCKBIT5 RAPID TRIAGE — $(hostname) — $(Get-Date) ===" | Out-File $out

"`n--- [1] Volume Shadow Copies (should be non-empty on servers) ---" | Out-File $out -Append
vssadmin list shadows 2>&1 | Out-File $out -Append

"`n--- [2] Scheduled Tasks Created in Last 7 Days ---" | Out-File $out -Append
Get-ScheduledTask | Where-Object { $_.Date -gt (Get-Date).AddDays(-7) } |
  Select-Object TaskName, TaskPath, Date, @{N='Action';E={$_.Actions.Execute}} |
  Format-Table -AutoSize | Out-File $out -Append

"`n--- [3] Suspicious Services (PsExec/RMM patterns) ---" | Out-File $out -Append
Get-CimInstance Win32_Service | Where-Object {
  $_.Name -match 'PSEXESVC|PAExec|ScreenConnect|AnyDesk|rclone' -or
  $_.PathName -match 'Temp|ProgramData\\[a-z0-9]{6,}\.exe'
} | Select-Object Name, State, PathName, StartName | Format-List | Out-File $out -Append

"`n--- [4] RDP Exposure ---" | Out-File $out -Append
$rdp = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections
"RDP Enabled: $(if($rdp.fDenyTSConnections -eq 0){'YES — VERIFY EXPOSURE'}else{'No'})" | Out-File $out -Append
Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue |
  Select-Object LocalAddress, LocalPort, State | Format-Table | Out-File $out -Append

"`n--- [5] VSS/Backup Tampering Events (last 7d) ---" | Out-File $out -Append
Get-WinEvent -FilterHashtable @{LogName='System'; Id=524,7036; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
  Select-Object TimeCreated, Id, Message | Format-List | Out-File $out -Append

"`n--- [6] Recent Logons Type 3/10 (network/RDP lateral movement) ---" | Out-File $out -Append
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; StartTime=(Get-Date).AddDays(-2)} -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match 'Logon Type:\s+(3|10)' } |
  Select-Object -First 30 TimeCreated, Message | Format-List | Out-File $out -Append

Write-Host "Triage complete: $out" -ForegroundColor Yellow

Incident Response Priorities — LOCKBIT5 Playbook

T-Minus Detection Checklist (Before Encryption Fires)

1. VSS deletion events — vssadmin delete shadows execution is the single highest-fidelity pre-detonation signal (typically <2 hours before encryption).
2. bcdedit recovery tampering — recoveryenabled no / bootstatuspolicy ignoreallfailures.
3. New services on multiple hosts — PSEXESVC 7045 events clustering across servers indicates deployment staging.
4. Mass file enumeration/archive creation — 7z/rar processes touching file shares, especially with -mhe (header encryption) flags.
5. rclone/MEGA/cloud sync traffic — outbound spikes to consumer cloud storage from servers.
6. Unauthorized RMM — any ScreenConnect/AnyDesk process not on your approved list, especially under ProgramData or user profiles.
7. Disablement of AV/EDR services — 7036 service-stop events on security tooling.

Critical Assets This Gang Prioritizes for Exfiltration

• File servers & SharePoint/Network shares — bulk document theft
• Legal, HR, and finance directories — contracts, PII, payroll (max extortion leverage)
• Backup infrastructure credentials and Veeam/Backup Exec consoles — destroyed before detonation
• Email archives (Executive + legal counsel mailboxes)
• OT/SCADA documentation in energy/utility victims — network diagrams, PLC configs (leverage material, rarely encrypted directly)

Containment Actions — Ordered by Urgency

1. Isolate, don't power off — network-quarantine affected hosts to preserve memory artifacts; kill lateral SMB/RDP paths immediately.
2. Disable compromised VPN concentrators — force-reset ALL VPN and local admin credentials; assume credential theft is total.
3. Block PsExec/WMI lateral spread — emergency firewall rules restricting 445/135/5985 to known admin jump hosts only.
4. Protect backups — take backup infrastructure off-network or verify immutability NOW; LockBit targets backups first.
5. Hunt for persistence before eradication — scheduled tasks, RMM agents, new local admins. Reimaging without persistence discovery guarantees reinfection.
6. Engage IR/legal early on leak-site exposure — negotiation timers (5–10 days) drive your disclosure clock; screenshot the leak listing for evidence.

Hardening Recommendations

Immediate (24 Hours)

• Patch Check Point Security Gateways (CVE-2026-50751) — disable IKEv1 where possible; audit VPN auth logs for anomalous successful authentications since 2026-06-08.
• Patch/audit ConnectWise ScreenConnect (CVE-2024-1708) — inventory ALL RMM tooling; block execution of unapproved RMM binaries via AppLocker/WDAC.
• Patch Exchange (CVE-2023-21529) — if Exchange 2016/2019 on-prem is unpatched, treat as exposed; review IIS logs for deserialization probes.
• Block outbound consumer cloud storage (MEGA, rclone endpoints, file.io) at the proxy from server VLANs.
• Enable and verify tamper protection on EDR; alert on any security service stop events.
• Deploy the Sigma rules above and run the Sentinel hunt query across the last 14 days.

Short-Term (2 Weeks)

• Segment backup infrastructure onto an isolated management network with immutable/air-gapped copies and separate credentials.
• Deploy a dedicated, monitored admin tier (PAW/jump hosts) — restrict SMB/WMI/WinRM to admin tier sources only; this single control breaks LockBit's deployment phase.
• Enforce phishing-resistant MFA (FIDO2) on all VPN and remote access — credential replay is this gang's bread and butter.
• Implement RMM allowlisting at the architecture level — only your sanctioned tool executes, everything else alerts.
• Tabletop a double-extortion scenario — legal, comms, and leadership need pre-agreed positions on leak-site exposure before a countdown timer forces the conversation.
• Deception — deploy canary VSS objects and honey file shares with alerting; LockBit affiliates will touch them during staging.

This briefing is based on direct observation of LOCKBIT5's dark web leak infrastructure via ransomware.live. Victim designations reflect claims made by the threat actor and do not constitute confirmation of compromise by the named organizations.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub