LockBit 5.0: The New Ransomware Variant That Hunts Your Servers

Lucas Daniels
Oct 2
4 min read

A Brief History of LockBit

LockBit is one of the most persistent and high-impact ransomware families operating today. It began in 2019 under the name ABCD (because encrypted files used the .abcd extension). Later it rebranded to LockBit.

Early versions focused on Windows systems, encrypting files and demanding ransom. Over time LockBit evolved:

LockBit 2.0 introduced StealBit, automating data exfiltration (not just encryption).
LockBit 3.0 (aka LockBit Black) added more stealth, obfuscation, worm-style spreading, and improved double-extortion tactics.
The group also adopted a Ransomware-as-a-Service (RaaS) model: core developers provide infrastructure and affiliates carry out attacks in return for a share of the ransom.
In February 2024, law enforcement agencies disrupted major parts of LockBit’s infrastructure in an operation called Operation Cronos, seizing servers, domains, and even source code elements.

Even after that, LockBit never truly disappeared. The infrastructure was rebuilt, affiliates regrouped, and now a more dangerous variant has surfaced.

What’s New in LockBit 5.0, Windows, Linux & ESXi

The major shift now is that LockBit 5.0 doesn’t just target Windows desktops and servers, it extends to Linux systems and ESXi virtualization environments (VMware).

Here are some key features seen so far:

The Windows version uses heavy obfuscation, reflection techniques, anti-analysis tactics, and event log clearing.
The Linux variant supports command-line options for specifying directories, file filters, and likely behaves similarly to the Windows version in terms of encryption and exfiltration.
The ESXi version is specifically designed to encrypt virtual machines and infrastructure. That makes it dangerous for organisations relying on VMware virtualization.
LockBit 5.0 uses randomized 16-character file extensions for encrypted files.
It also attempts to avoid infecting systems with Russian language settings (a common tactic among groups residing in Russian-speaking regions) and clears event logs after encryption.

Because of the cross-platform reach, attackers can now hit servers, cloud Linux systems, containers, and virtual machine hosts, not just Windows desktops. That expands the attack surface immensely.

Why This Is Especially Dangerous for Businesses

1. Servers Are High Value

Your servers hold databases, APIs, internal tools, backups, and customer data. If a Linux server or VM hypervisor is encrypted, you may lose access to entire applications or infrastructure layers, not just user machines.

2. Virtualisation Layer Targeting

With ESXi support, LockBit 5.0 can jump into your virtualization infrastructure and encrypt entire VM images or storage, compounding damage. Even if endpoints survive, their hosts may go down.

3. Lateral Movement Across Platforms

An attacker may gain entry via a compromised Windows machine or credential, and then pivot into Linux servers or virtual hosts to inflict wider damage.

4. Detection Difficulty & Stealth

Because many security teams focus on Windows detection, Linux or hypervisor environments may be less monitored. New variants with obfuscation and log suppression make detection harder.

5. RaaS Model Means Fast Spread

LockBit’s model allows affiliates to pick up these improved versions quickly. The speed of adoption across many targets increases threat velocity.

What You Should Be Doing Right Now

Here are practical, prioritized steps your team (even without a large security department) can start applying:

1. Harden All Server Access

Use least privilege: only allow the minimum necessary permissions on Linux servers, VM hosts, and administrative accounts.
Use strong authentication: enforce MFA or hardware keys for server access, especially via SSH or administrative portals.
Use jump hosts or bastion hosts and restrict direct access to critical hosts.

2. Patch and Update Regularly

Keep operating systems, hypervisor software, and virtualization stack up to date.
Monitor for LockBit 5.0 indicators and apply vendor patches or mitigations as they are published.
Do not delay updates in server environments; make them part of your deployment cycle.

3. Network Segmentation and Isolation

Segment production, dev, staging, and management networks so that if one environment is breached, it’s harder for attackers to jump elsewhere.
Create strict firewall rules: only allow required ports and services, especially between segments.
Isolate hypervisors and management planes, those should not be cohosted with general workloads.

4. Backup Strategy That Counts

Use the 3-2-1 backup rule: three copies, two different media, one off-site or offline.
Ensure backups of key Linux servers, VM images, and hypervisor configurations are stored offline or in immutable storage (so attackers can’t overwrite them).
Test your backups periodically, make sure you can restore fully.

5. Monitoring, Detection & Logging

Collect logs from Linux servers, hypervisors, and management systems.
Monitor for unusual file encryption activity, new processes, or directory scanning behaviour.
Alert on anomalous CPU usage, access spikes, or unfamiliar scripts running on servers.
Use file integrity monitoring (FIM) tools for critical config files or binaries.

6. Vendor and Third-Party Hygiene

If you're running managed services or third-party plugins on your servers or virtualization layers, audit their security practices.
Limit the privileges those third parties get and monitor their activity.

7. Incident Response Readiness

Maintain a clear incident response plan that includes server / hypervisor compromise paths.
Practice tabletop exercises that include cross-platform scenarios (Windows → Linux → ESXi).
Prepare for isolation, containment, and restoration from backups under ransomware scenarios.

8. Least Trust for New Code & Deployments

When deploying new code or software agents on Linux servers or VMs, review it carefully. Don’t let unvetted code run as root or with broad privileges.
Use code signing and package integrity checking wherever possible.

Conclusion

LockBit 5.0 is a reminder that ransomware is evolving rapidly, and the days when only Windows endpoints mattered are over. Its Linux and ESXi capabilities mark a shift: your servers and infrastructure are now prime targets.

If your team is already thinking “we protect user machines, but not so much our servers,” it’s time to flip that mindset. Harden, segment, monitor, backup, and be ready to respond.

If you’d like help walking through a server security review, backup checklist, or threat response plan for mixed OS environments, I’m happy to help. At Steel FYI, we aim to keep your infrastructure resilient, even when attackers diversify.