LockBit 5.0 marks a significant upgrade in the ransomware world, hitting Windows, Linux, and VMware ESXi systems with fast ChaCha20 encryption.
This version evades detection better than past ones, scoring just 1/65 on VirusTotal at analysis time.
It replaces older AES methods with ChaCha20, a stream cipher that processes large data volumes quickly without standard libraries, boosting speed and stealth.
Affiliates get flexible command-line options to tweak encryption, exclusions, and modes across platforms.
Threat Landscape
LockBit operates as ransomware-as-a-service (RaaS), with developers handling tools and leaks while affiliates deploy attacks for profit-sharing.
This model drives high volume and impact, with recent ties to groups like DragonForce and Qilin in a cartel-like setup.
The group resurfaced after the 2024 takedowns, releasing 5.0 in September 2025 to target diverse enterprise setups.
Cross-platform support lets attackers hit endpoints, servers, and hypervisors simultaneously, crippling networks.
ESXi Variant Breakdown
ESXi ransomware focuses on hypervisors hosting many VMs, encrypting .vmdk disks, .vmx configs, vswp swaps, and more to disrupt dozens of systems at once.
The 64-bit Linux ELF binary lacks anti-analysis section headers and links to libpthread for multi-threaded encryption.
It checks the environment with “vmware -v”, lists VMs via “/bin/vim-cmd vmsvc/getallvms”, and powers them off using “vmsvc/power.off” to free locks.
A fast pass marks files like .vmdk.fastpass with 1% encryption, followed by full ChaCha20.
Options include -f for fast mode, -d for directories, -l logging to /var/log/encrypt.log, -r for encryption percent (10-90%), and -n to skip VMs by ID. Exclusions protect /proc, /dev, /sys, bootbanks, /etc, /lib, /bin to keep the host bootable.
Anti-analysis scans /proc/self/maps for TracerPid, blocks valgrind, frida, strace, and sanitizers like asan.[query] Post-encryption, it self-deletes and may wipe free space.
According to Level Blue, the malware uses two passes: quick partial then thorough ChaCha20, initialized with “expand 32-byte k” constant.
Strings reveal “LINUX Locker v1.07” and “LOCKBIT5.0”, confirming targeting.
On ESXi, it runs commands like “ps | grep vmx | grep ‘%s'” to find VM processes and skips bypass-listed VMs with “[INFO] VM %s (ID: %d) in bypass list”.
Progress logs show “[OK] VM %s (ID: %d) powered off.”
The i386 ESXi variant, labeled “LINUX Locker v1.06”, shares logic but optimizes for 32-bit operation, using Poly1305 ops and string obfuscation via rotates.
All variants share hashing, API resolution from LockBit 4.0, proving evolution.
Defenders should patch ESXi, segment hypervisors, monitor vim-cmd abuse, and block unusual ELF binaries in /vmfs.
Watch for randomized 16-char extensions, Russian locale skips, and ETW patches on Windows.
LockBit 5.0’s modular design, mutexes, delays, and in-memory loads raise the bar. Enterprises need cross-platform EDR, offline backups, and threat hunting for vim-cmd, ChaCha20 spikes.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
