LOCKBIT5 Ransomware Gang: 6 Victims Posted in 24 Hours — Financial Services & Manufacturing Targeting Analysis with Detection Rules

Classification: TLP:CLEAR | Published: 2026-09-03 | Source: ransomware.live dark web monitoring, CISA KEV

Executive Summary

Security Arsenal's dark web monitoring confirms LOCKBIT5 posted six new victims to its .onion leak site in a single 24-hour window on 2026-08-31 — a concentrated drop that signals either a batch detonation event or an affiliate push to clear backlogged access. Targeting spans Financial Services, Professional Services, and Manufacturing across the United States, Japan, and the Netherlands. Organizations in these sectors — particularly mid-market firms with perimeter VPN appliances and legacy Exchange infrastructure — should treat this as an active threat window.

Threat Actor Profile — LOCKBIT5

LOCKBIT5 represents the post-takedown reconstitution of the LockBit brand following the 2024 Cronos disruption. The operation retains the franchise model: access quality is inconsistent, but affiliates favor low-friction perimeter exploitation over sophisticated phishing. The single-day, six-victim drop is characteristic of an affiliate batch-publishing victims whose negotiations failed simultaneously — often a sign of a shared initial access vector or a single IAB feed.

Current Campaign Analysis

Victimology (2026-08-31 posting wave)

Sector Concentration

• Professional Services & Financial Services dominate the high-value end: the credit union (svfcu.org) and the law firm (hoaattorneys.com) hold regulated PII and client-privileged data — prime double-extortion leverage. Legal firms handling HOA/real-estate matters store banking details and wire instructions, enabling downstream BEC.
• Dutch manufacturing cluster (3 of 6 victims) suggests a regional access broker feed or exploitation of a common NL-market MSP/RMM stack.

Geographic Pattern

US (2) / JP (1) / NL (3). The NL concentration is statistically anomalous for LOCKBIT5's historical US-weighted victimology and warrants attention from European mid-market manufacturers.

Victim Profile

All six are SMB-to-mid-market organizations (estimated 25–500 employees, $5M–$250M revenue) — the classic LockBit affiliate sweet spot: large enough to pay six-to-seven figures, small enough to lack 24×7 SOC coverage and mature EDR posture.

Posting Frequency / Escalation

A synchronized six-victim drop after lower baseline activity indicates a campaign pulse, not organic trickle. Expect a follow-on wave within 7–14 days if this reflects a single IAB access batch.

CVE Correlation — Likely Initial Access Vectors

Based on LOCKBIT5 affiliate tradecraft and the CISA KEV entries flagged with confirmed ransomware use:

• CVE-2026-50751 (Check Point Security Gateway — improper authentication in IKEv1 key exchange): Highest-probability vector for this wave. Perimeter VPN exploitation matches the geographic spread and the simultaneous timing — one affiliate scanning and exploiting exposed gateways can seed multiple intrusions in parallel. If you run Check Point gateways: assume targeted.
• CVE-2024-1708 (ConnectWise ScreenConnect — path traversal → RCE): Strong candidate for the NL manufacturing cluster; MSP-deployed ScreenConnect instances are a documented LockBit affiliate entry point.
• CVE-2025-60710 (Windows link-following privilege escalation) and CVE-2023-21529 (Exchange deserialization): Post-access privilege escalation and lateral movement enablers, consistent with known LOCKBIT5 in-network tooling.
• CVE-2026-48027 (Nx Console embedded malicious code): Supply-chain vector targeting developer workstations — relevant for professional services firms with in-house dev teams.

Detection Engineering

The following detections target LOCKBIT5's documented playbook: perimeter VPN exploitation → RMM/living-off-the-land tooling → WMI/PsExec lateral movement → data staging → shadow copy deletion → encryption.

---
title: LockBit5 - Check Point VPN Exploitation Followed by Suspicious Authentication
description: Detects anomalous authentication patterns on perimeter VPN gateways consistent with CVE-2026-50751 exploitation — successful logon from a new source IP shortly followed by internal RDP/SMB connections
status: experimental
author: Security Arsenal Threat Intel
logsource:
  product: checkpoint
  service: vpn
detection:
  selection_success:
    event_type: 'login_success'
  filter_geo:
    src_ip_geo_country:
      - 'RU'
      - 'NL-unknown-egress'
      - 'TOR-exit'
  timeframe: 15m
  condition: selection_success and filter_geo
falsepositives:
  - Legitimate roaming users on uncommon egress IPs
level: high
tags:
  - attack.initial_access
  - attack.t1133
  - attack.t1190
---
title: LockBit5 - Mass Lateral Movement via PsExec or WMI Service Creation
description: Detects service creation events across multiple hosts from a single source within a short window — LockBit affiliates push encryptors via PsExec/WMI after staging
status: experimental
author: Security Arsenal Threat Intel
logsource:
  product: windows
  category: ps_classic_start
  definition: 'EventID 7045 service installation'
detection:
  selection:
    EventID: 7045
    ServiceFileName|contains:
      - '\ADMIN$'
      - 'PSEXESVC'
      - '\AppData\Local\Temp\'
      - 'rundll32.exe'
      - 'paExec'
  condition: selection
falsepositives:
  - Legitimate software deployment tools (SCCM, PDQ) — whitelist known deployment service accounts
level: critical
tags:
  - attack.lateral_movement
  - attack.t1569.002
  - attack.t1021.002
---
title: LockBit5 - Pre-Encryption Staging Behavior
description: Detects the classic pre-detonation sequence — Volume Shadow Copy deletion, boot configuration tampering, and backup catalog removal executed within a single session
status: experimental
author: Security Arsenal Threat Intel
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    CommandLine|contains:
      - 'vssadmin delete shadows'
      - 'vssadmin Delete Shadows'
  selection_wmic:
    CommandLine|contains:
      - 'shadowcopy delete'
  selection_bcdedit:
    CommandLine|contains:
      - 'bcdedit'
      - 'recoveryenabled no'
      - 'ignoreallfailures'
  selection_wbadmin:
    CommandLine|contains:
      - 'wbadmin delete catalog'
      - 'wbadmin delete systemstatebackup'
  condition: 1 of selection_*
falsepositives:
  - Rare legitimate backup maintenance — correlate with parent process and session context
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.t1562.001

The following Microsoft Sentinel hunt query identifies pre-ransomware staging: hosts exhibiting the combination of mass file reads (staging), shadow copy tampering, and remote execution artifacts within a 24-hour window — the LOCKBIT5 dwell-time signature.

// LockBit5 Pre-Ransomware Staging Hunt — Microsoft Sentinel
// Looks for: VSS deletion + suspicious process lineage + remote service execution on common hosts
let TimeWindow = 24h;
let VssTamper =
    DeviceProcessEvents
    | where TimeGenerated > ago(TimeWindow)
    | where ProcessCommandLine has_any ("vssadmin delete shadows", "shadowcopy delete", "recoveryenabled", "wbadmin delete catalog", "resize shadowstorage")
    | project VssHost = DeviceName, VssTime = TimeGenerated, VssCmd = ProcessCommandLine, VssAccount = AccountName;
let RemoteExec =
    DeviceEvents
    | where TimeGenerated > ago(TimeWindow)
    | where ActionType == "ServiceInstalled"
    | extend Parsed = parse_json(AdditionalFields)
    | where tostring(Parsed.ServiceName) has_any ("PSEXESVC", "paexec") or tostring(Parsed.ServiceCommand) has_any ("ADMIN$", "Temp")
    | project ExecHost = DeviceName, ExecTime = TimeGenerated, ServiceDetail = tostring(Parsed.ServiceName);
let StagingReads =
    DeviceFileEvents
    | where TimeGenerated > ago(TimeWindow)
    | where ActionType == "FileCreated"
    | where FolderPath has_any ("\\Documents\\", "\\Finance\\", "\\Shared\\", ".pst", ".bak", ".sql", ".mdf")
    | summarize ArchiveCandidates = count(), TargetPaths = make_set(FolderPath, 20) by DeviceName, InitiatingProcessFileName
    | where ArchiveCandidates > 500;
VssTamper
| join kind=inner (RemoteExec) on $left.VssHost == $right.ExecHost
| join kind=inner (StagingReads) on $left.VssHost == $right.DeviceName
| project VssHost, VssTime, VssCmd, VssAccount, ServiceDetail, ArchiveCandidates, InitiatingProcessFileName
| sort by VssTime desc

The following PowerShell script is a rapid-response triage tool for the IR priorities below: it surfaces indicators LOCKBIT5 affiliates leave behind in the final 72 hours before detonation.

# LockBit5 Rapid Triage — pre-ransomware indicator sweep (run elevated on suspect hosts)
# Checks: recent scheduled tasks, shadow copies, RDP exposure, suspicious services, staged archives
Write-Host "=== LockBit5 Pre-Detonation Triage: $env:COMPUTERNAME ===" -ForegroundColor Cyan

Write-Host "`n[1] Scheduled tasks created in last 7 days:" -ForegroundColor Yellow
Get-ScheduledTask | Where-Object { $_.Date -and ([datetime]$_.Date) -gt (Get-Date).AddDays(-7) } |
    Select-Object TaskName, TaskPath, Date, @{N='Author';E={$_.Author}} | Format-Table -AutoSize

Write-Host "`n[2] Volume Shadow Copies (LockBit deletes these pre-encryption):" -ForegroundColor Yellow
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $shadows) { Write-Host "  !! NO SHADOW COPIES FOUND — potential T1490 tampering !!" -ForegroundColor Red }
else { $shadows | Select-Object ID, InstallDate, VolumeName | Format-Table -AutoSize }

Write-Host "`n[3] RDP exposure & recent RDP logons:" -ForegroundColor Yellow
$rdpEnabled = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server').fDenyTSConnections
Write-Host "  RDP Deny flag = $rdpEnabled (0 = RDP ENABLED)"
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; LogonType=10} -MaxEvents 15 -ErrorAction SilentlyContinue |
    Select-Object TimeCreated, @{N='SrcIP';E={$_.Properties[18].Value}}, @{N='User';E={$_.Properties[5].Value}} | Format-Table -AutoSize

Write-Host "`n[4] Suspicious services installed in last 7 days (PsExec/RMM/encryptor droppers):" -ForegroundColor Yellow
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045} -ErrorAction SilentlyContinue |
    Where-Object { $_.TimeCreated -gt (Get-Date).AddDays(-7) } |
    Select-Object TimeCreated, @{N='Service';E={$_.Properties[0].Value}}, @{N='Binary';E={$_.Properties[1].Value}} | Format-Table -AutoSize

Write-Host "`n[5] Large archives staged in last 7 days (exfil staging):" -ForegroundColor Yellow
foreach ($drive in (Get-PSDrive -PSProvider FileSystem).Root) {
    Get-ChildItem -Path $drive -Recurse -Include *.rar,*.7z,*.zip -ErrorAction SilentlyContinue -Depth 3 |
        Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) -and $_.Length -gt 100MB } |
        Select-Object FullName, @{N='SizeMB';E={[math]::Round($_.Length/1MB)}}, LastWriteTime
}

Write-Host "`n[6] BCD recovery settings (LockBit disables recovery):" -ForegroundColor Yellow
bcdedit | Select-String -Pattern 'recoveryenabled|bootstatuspolicy'

Write-Host "`n=== Triage complete. Escalate any RED findings to IR immediately. ===" -ForegroundColor Cyan

Incident Response Priorities

T-Minus Detection Checklist (before encryption fires)

1. vssadmin/wmic/bcdedit execution on any server — the single highest-fidelity pre-detonation signal.
2. New scheduled tasks pushing payloads to remote hosts, especially tasks running as SYSTEM with encoded PowerShell or rundll32 payloads.
3. Unexpected RMM tooling (ScreenConnect, AnyDesk, Atera, Splashtop) present where IT did not deploy it — LockBit affiliates use RMM for persistence and payload distribution.
4. Mass file-read/archive creation on file servers followed by sustained outbound transfers >50GB to unfamiliar cloud storage (MEGA, Backblaze B2, Wasabi) or VPS IPs.
5. VPN gateway authentication anomalies — successful logins from new geographies/ASNs against Check Point appliances (CVE-2026-50751), especially outside business hours.
6. PsExec service artifacts (EventID 7045, PSEXESVC) appearing on multiple hosts from a single source within minutes.

Critical Assets LOCKBIT5 Affiliates Prioritize for Exfiltration

• Financial/accounting data: QuickBooks files, banking credentials, wire transfer records, tax documents (credit unions and law firms: assume targeted).
• Client-privileged data: case files, contracts, escrow and wire instructions — primary extortion leverage against professional services firms.
• HR/PII stores: payroll exports, identity documents — enables secondary fraud and regulatory pressure.
• Manufacturing IP: CAD files, BOMs, supplier contracts (relevant to the NL cluster).
• Backup catalogs and snapshots — targeted for destruction, not exfiltration, to force payment.

Containment Actions — Ordered by Urgency

1. Isolate at the network layer, do NOT power off — preserve volatile memory for forensics; segment affected VLANs.
2. Disable compromised accounts and force enterprise-wide credential resets, prioritizing VPN, domain admin, and service accounts.
3. Block egress to known exfil destinations (consumer cloud storage, suspicious VPS ranges) at the proxy/firewall immediately.
4. Revoke/disable any unauthorized RMM agents and audit RMM logs for remote session history.
5. Take domain controllers offline from the network if PsExec/WMI spread is observed; protect a known-good DC copy.
6. Verify backup integrity and isolation before any recovery action — assume attackers enumerated backup infrastructure.

Hardening Recommendations

Immediate (24 hours)

• Patch Check Point Security Gateways against CVE-2026-50751 or disable IKEv1 if patching is not immediately possible; audit gateway auth logs for the past 30 days.
• Patch or isolate ConnectWise ScreenConnect (CVE-2024-1708); inventory ALL RMM tools in the environment and remove any unauthorized instances.
• Apply Exchange Server updates for CVE-2023-21529 and Windows updates for CVE-2025-60710.
• Block macro execution from internet-sourced Office documents via GPO; enforce Mark-of-the-Web handling.
• Alert-on-creation (not just deletion) for Volume Shadow Copy operations — deploy the Sigma rule above now.
• Deny outbound traffic to consumer cloud storage for server VLANs; alert on sustained >10GB outbound transfers.
• Enforce MFA on all VPN and RDP access; disable RDP from the internet entirely.

Short-Term (2 weeks)

• Segment the network: isolate file servers, backup infrastructure, and OT/manufacturing segments (critical for the NL manufacturing cluster's peer organizations) from general user VLANs.
• Deploy application control (WDAC/AppLocker) to block unauthorized RMM binaries and rundll32 abuse.
• Implement LSA protection and Credential Guard; rotate all service accounts to gMSA.
• Move to immutable, off-network backups (3-2-1 with an air-gapped or object-lock tier) and test restoration.
• Establish EDR coverage on all servers including domain controllers — LOCKBIT5 affiliates specifically hunt for coverage gaps.
• Vendor/MSP audit: review third-party remote access paths, since the NL cluster pattern suggests an MSP or shared-tooling vector.

Analyst Assessment

The 2026-08-31 six-victim pulse is consistent with a LOCKBIT5 affiliate clearing a batch of Check Point or RMM-derived access. The Dutch manufacturing concentration is the most actionable signal for European defenders, and the financial services hit (a US credit union) elevates regulatory exposure risk. Organizations running Check Point gateways, ConnectWise ScreenConnect, or unpatched Exchange should treat themselves as in-scope for this campaign and run the triage script above within 24 hours.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub