Mumbai – The Acronis Threat Research Unit (TRU) has identified a new and significantly enhanced version of the LockBit ransomware, LockBit 5.0, currently being deployed in active campaigns. The latest variant demonstrates expanded cross-platform capabilities, enabling attackers to target Windows, Linux, and VMware ESXi systems within a single coordinated attack.
According to Acronis TRU’s analysis, LockBit 5.0 introduces dedicated builds tailored for enterprise environments, reflecting the continued evolution of ransomware-as-a-service (RaaS) operations. By supporting multiple operating systems and virtualization platforms, the threat actors are positioning themselves to compromise endpoints, servers, and hypervisors, simultaneously increasing the potential scale and severity of attacks.
The Windows variant incorporates advanced defense-evasion techniques, including obfuscation and anti-analysis mechanisms designed to bypass detection tools and disrupt monitoring systems. Meanwhile, the Linux and ESXi versions are engineered to target critical infrastructure and virtual machines, allowing attackers to encrypt multiple workloads at once and cause widespread operational disruption.
Acronis TRU researchers observed that LockBit 5.0 continues to rely on strong encryption routines and appends encrypted files with randomized extensions, making recovery without secure backups significantly more challenging. The ESXi-focused functionality is particularly concerning, as compromising a single hypervisor host can impact numerous virtual machines simultaneously.
The emergence of LockBit 5.0 highlights the resilience and adaptability of ransomware groups, even amid sustained global law enforcement efforts aimed at dismantling their infrastructure. The release of this upgraded version signals an ongoing shift toward targeting enterprise-grade systems and virtualization environments.
Acronis TRU advises organizations to adopt a layered security strategy, including comprehensive endpoint and server protection, network segmentation, strong access controls such as multi-factor authentication, and regularly tested offline backups. As ransomware operators continue to expand their technical sophistication and platform reach, cross-environment visibility and proactive cyber resilience measures are becoming increasingly critical for enterprise defense.
For more information about the report and its findings with additional insights, visit the blog: https://www.acronis.com/en/tru/posts/lockbit-strikes-with-new-50-version-targeting-windows-linux-and-esxi-systems/
