LockBit 5.0 Ransomware Targets Windows, Linux, and VMware ESXi Systems

Cybersecurity researchers at Trend Micro have discovered a new and dangerous variant of LockBit ransomware that targets Windows, Linux, and VMware ESXi systems, utilizing advanced obfuscation techniques and sophisticated cross-platform capabilities.

Advanced Multi-Platform Attack Strategy

LockBit 5.0 represents a significant evolution in ransomware threats, featuring dedicated variants for three critical computing platforms.

• The Windows variant employs heavy obfuscation and packing techniques, loading its payload through DLL reflection while implementing sophisticated anti-analysis methods including ETW patching and automatic termination of security services.

• The Linux variant maintains similar functionality with command-line options allowing attackers to target specific directories and file types, as reported by Trendmicro.
• Most concerning is the ESXi variant, which specifically targets VMware virtualization infrastructure, enabling attackers to encrypt entire virtual machine environments with single execution.

All variants share critical behavioral characteristics designed to maximize damage while avoiding detection systems.

The ransomware generates randomized 16-character file extensions for encrypted files, complicating recovery efforts.

Like previous LockBit versions, it includes geopolitical safeguards that terminate execution when detecting Russian language settings or geolocation.

The malware implements multiple anti-forensics techniques, including patching EtwEventWrite API to disable Windows Event Tracing and clearing event logs post-encryption.

It systematically terminates security services by comparing hashed service names against hardcoded lists.

Code Analysis Reveals Evolution

Comparative analysis between LockBit 4.0 and 5.0 reveals significant code reuse, indicating evolution of existing malware rather than complete rewrite.

Both versions share identical hashing algorithms and API resolution methods, confirming continuity in the LockBit ransomware family.

The Windows version features improved user interface with clean formatting and detailed help commands, providing attackers extensive customization options including encryption modes, directory targeting, and operational visibility settings.

The dedicated ESXi variant poses particular risks to enterprise environments, as ESXi servers typically host multiple virtual machines.

Successful attacks can encrypt entire virtualized environments, significantly amplifying business disruption potential and ransom demands across organizations worldwide.

LockBit 5.0 demonstrates several technical improvements over predecessors, including removed traditional infection markers, faster encryption processes, and enhanced evasion capabilities.

Heavy obfuscation across all variants significantly delays security signature development, making detection more challenging for security teams globally.

The existence of Windows, Linux, and ESXi variants confirms LockBit’s sophisticated cross-platform strategy, enabling simultaneous attacks across complete enterprise networks.

Organizations must implement comprehensive multi-platform defenses, with particular attention to protecting virtualization infrastructure and critical business systems.

Despite February 2024’s Operation Cronos law enforcement action that disrupted LockBit infrastructure, the group demonstrates remarkable resilience through this latest release.

The ransomware-as-a-service model continues evolving rapidly, making LockBit 5.0 significantly more dangerous than previous versions, requiring immediate comprehensive security updates.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.