LockBit5

LockBit5 is the current build of the LockBit ransomware-as-a-service operation. LockBit was the dominant ransomware platform from 2022 to 2024, behind thousands of attacks on hospitals, schools, critical infrastructure and professional-services firms. The FBI estimated that it had taken more than $120m in ransom payments before February 2024. Mandiant found LockBit affiliates among those exploiting the CitrixBleed flaw (CVE-2023-4966) in 2023.

In February 2024 Operation Cronos, led by Britain's National Crime Agency with Europol and the FBI, seized LockBit's servers, arrested affiliates in several countries, recovered decryption keys and partly exposed the administrator known as LockBitSupp. LockBitSupp rebuilt the operation on a new leak site, and the rebuilt platform trades as LockBit5.

By April 2026 LockBit5 and DragonForce were posting more victims than any other crews. The wider market had not shrunk after Cronos: trackers counted 808 ransomware victim postings from 65 active groups in March 2026, up 19 per cent on February and 33 per cent above the 2025 monthly average. April postings rose 8.4 per cent year on year but slipped 2.4 per cent from March.