Threat Group Profile
lockbit5
● Active — last 30 days
Victim claims
103
First seen
Mar 2026
Last activity
19 Jun 2026
Tracked since
Dec 2025
Group overview
LockBit 5.0 ("ChuongDong") emerged in September 2025 as the group's resurgence following the February 2024 law enforcement takedown, introducing cross-platform payloads targeting Windows, Linux, and VMware ESXi with enhanced evasion capabilities and continuing the RaaS affiliate model of its predecessors.
Preferred targets
Business Services · 18
Manufacturing · 16
Healthcare · 9
Agriculture and Food Production · 9
Consumer Services · 7
Hospitality and Tourism · 5
Most targeted countries
US · 11
DE · 9
IT · 7
BR · 7
TH · 5
NL · 4
