Search Ransomware Intelligence
Jump to a group, country, industry or search victims.
LockBit 5.0
As of Oct 19, 2026, LockBit 5.0 has listed 393 confirmed victims on its leak site since Jan 23, 2025, 1.2% of all victims tracked by Brandefense. Its most targeted country is United States (18.8% of its victims) and its most targeted sector is Manufacturing.
LockBit 5.0 ("ChuongDong") emerged in September 2025 as the group's resurgence following the February 2024 law enforcement takedown, introducing cross-platform payloads targeting Windows, Linux, and VMware ESXi with enhanced evasion capabilities and continuing the RaaS affiliate model of its predecessors.
Follow and IOC feeds are part of the Brandefense platform.
- Confirmed Victims
- 393
- Rank By Victims
- #17
- Last Leak-Site Post
- Oct 16, 2026
- Top Country
- United States
- Top Sector
- Manufacturing
Victims Posted Per Month.
| Month | Confirmed victims |
|---|---|
| May 2026 | 25 |
| June 2026 | 47 |
| July 2026 | 15 |
| August 2026 | 22 |
| September 2026 | 19 |
| October 2026 (month in progress) | 15 |
| Month | Confirmed victims |
|---|---|
| November 2025 | 0 |
| December 2025 | 96 |
| January 2026 | 12 |
| February 2026 | 34 |
| March 2026 | 49 |
| April 2026 | 37 |
| May 2026 | 25 |
| June 2026 | 47 |
| July 2026 | 15 |
| August 2026 | 22 |
| September 2026 | 19 |
| October 2026 (month in progress) | 15 |
| Month | Confirmed victims |
|---|---|
| January 2025 | 2 |
| February 2025 | 0 |
| March 2025 | 6 |
| April 2025 | 10 |
| May 2025 | 1 |
| June 2025 | 0 |
| July 2025 | 0 |
| August 2025 | 0 |
| September 2025 | 2 |
| October 2025 | 1 |
| November 2025 | 0 |
| December 2025 | 96 |
| January 2026 | 12 |
| February 2026 | 34 |
| March 2026 | 49 |
| April 2026 | 37 |
| May 2026 | 25 |
| June 2026 | 47 |
| July 2026 | 15 |
| August 2026 | 22 |
| September 2026 | 19 |
| October 2026 (month in progress) | 15 |
Latest LockBit 5.0 Victims.
Search all 393 →| Victim | Country | Industry | Data claimed | Posted |
|---|---|---|---|---|
| ock.com.my ock.com.my | MYMalaysia | Technology | Not stated | |
| karix.com karix.com | INIndia | Telecommunications | Not stated | |
| torcivialaw.com torcivialaw.com | USUnited States | Legal Services | Not stated | |
| kidzrkooldental.com kidzrkooldental.com | USUnited States | Healthcare | Not stated | |
| lcww.com.eg lcww.com.eg | EGEgypt | Energy and Utilities | Not stated | |
| neweramachines.com neweramachines.com | INIndia | Manufacturing | Not stated |
How They Operate.
LockBit 5.0's threat actor profile lists 22 ATT&CK techniques, 20 malware and tools, with its targets and related actors.
TTPs, CVEs and malware →Who LockBit 5.0 Targets.
Sectors
History.
First confirmed victim listed on its leak site
Busiest month on record: 96 confirmed victims
First seen in Brandefense data
Most recent leak-site post
Get Real-Time Alerts, IOC Feeds And Takedowns.
The Brandefense platform watches every leak site for your company, vendors and executives, and acts on what it finds.