NOTE: I started this story before Operation Cronos. Hence you can see tiny details getting unfold before the FBI/Europol Compromise and afterwards. This article mainly focuses on the mighty comeback of LockBit Group and their approach after Operation Cronos and does NOT attribute to the Identity of LockBitSupp. Moreover, it is a collection of events in the LOCKBIT Series observed that had gone unnoticed and also discusses about the periodic development of LockBit Group Activities.

1. INTRODUCTION
2. THE COMEBACK
3. VICTIMIZATION
4. LOCKBIT INFRASTRUCTURE HUNT
5. LOCKBIT MOVING TO TORRENT FILE SHARES
6. VICTIM CASE STUDY: CRINETICS
7. LOCKBIT LEAK HOSTING
8. UNRELATED LOCKBIT DOMAIN
9. LOCKBIT IMITATORS AROUND
10. LOCKBIT AFFILIATE?
11. REALITY CHECK?
12. LEAK DATE EXTENSION: ADOPTION OF NEWER APPROACH
13. OPERATION CRONOS: PART 2
14. LOCKBIT TOX STATUS UPDATES
15. CONCLUSION
16. UPDATE 1
17. UPDATE 2
18. 💡INSIDE LOCKBIT4.0 CHAT
19. 💡INTELLIGENCE: LOCKBIT4.0 SAMPLES
20. LOCKBIT 5.0 ANNOUNCEMENT
21. LOCKBIT 5.0 SAMPLE ANALYSIS
22. USES OF VHASH IN THREAT HUNTING
23. LOCKBIT 5.0 VICTIMS ANNOUNCED
24. 💡LOCKBIT 5.0: EXPOSING REAL IP
25. 💡LEAK CLAIM ANALYSIS
26. LOCKBIT 5.0 RESPONSE
27. LOCKBIT ANNOUNCED NEW TOR DOMAINS FOR TORRENT
28. PANEL INFILTRATION
29. IOC

INTRODUCTION

After the ban of LockBit on forums like XSS or Exploit and Law Enforcement Infiltration of LockBit via Operation Cronos, it is evident that the group had lost a few of their internal files such as Negotiation Panel, Affiliated Member List, Victim Database, Chats and Decryption Keys got exposed to the public and their well-built reputation got a taint.

Initially, on their comeback, LockBit had published past leaks (before Operation Cronos). But the same had been criticized in the infosec community about the re-use of old leaks, the Group had withdrawn it and came back with a fresh batch of victims.

This article is purely going to focus on the 2nd reign of LOCKBIT!

THE COMEBACK

After OPERATION CRONOS Part 1, it took about a week for LockBit to resurface with their all mirror servers back online with listing new victims on their Data Leak Site (DLS).

All the victims are given an average of 29-Day negotiation time frame before leaking the entire data on the LockBit leak servers to the public.

Currently, the victim list is clocked at 200+ (Post Operation Cronos) which signifies their strong presence in the Corporate Ransomware Scenario.

NOTE: Operation Cronos had made a greater impact to cripple LockBit. But the group goes strong defending all the drawbacks.

VICTIMIZATION

LockBit started to victimize more often, even including reputed targets such as the US Government wing DSIB — The Government of the District of Columbia Department of Insurance, Securities and Banking (DISB) regulates financial-service businesses, Polycab, OracleCMS, Nampak, Crinetics, etc.

However, it is found that the victim’s data appears lately on their site, unlike it was a regular upload feature before Operation Cronos.

In some cases (such as Polycab, Krueth and CasaJove); the leaks are not yet listed even after the deadline, which is suspicious. This could be due to the loss of data from LockBit at the time of Operation Cronos OR the victims might have paid the ransom.

While checking the Victim Geography, we can see that the US tops the list; followed by the UK, Germany, Canada, India, and France.

NOTE: While analyzing the data, it was found that LockBit had listed 235 Victims (ATTOW) after Operation Cronos Part 1 & 2. For info, you may contact me.

LOCKBIT INFRASTRUCTURE HUNT

During the analysis, it was found that LockBit maintains a stable server to host large leaks on a new Onion Domain:-

lockbit33chewwx25efq6dgkhkw4u7nefudq4ijkuamjfd7x73on6dyd.onion

This leak site is running on nginx/1.25.4; which is the latest version of NGINX (ATTOW) as promised by LockBit to avoid any unpatched versions after Operation Cronos Part — 1.

Their main DLS is the following which is running on nginx/1.24.0

lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion

During my research, LockBit’s original IP got exposed:-

By digging further, we can extrapolate the following details:-

IP: 5.182.5.126 
ASN: 49505
Location: Russia
Server: NGINX 

NOTE: The same IP has a historic connection with a domain: waralbum.ru which was associated with BuhTrap Banking Trojan in 2016

Old LockBit Servers (now controlled by Europol or Operation Cronos) were using Apache/2.4.57 (Debian). The LockBit group had moved to the NGINX server with the newest stable Onion Domains.

LOCKBIT MOVING TO TORRENT FILE SHARES

On March 9, 2024 LockBit Operators made 18 Vanity Onion Domains online listing about 710+ Clients, along with Torrent Files to make downloading easier.

NOTE: All the Onion Domains are listed at the end of the article in the IOC Section

In mid-November 2023: Lockbit decided to make Torrent files for all of its victims for easier accessibility. All victim’s data (Torrent Version) packaged and assigned a 5-Char name instead of a company name such as I85F5, 7E6EE, V4DV5, LIHD9, PLPT7 etc.

While digging further, it is also observed that a file tree for each victim is also being created on the same day i.e. 9th March 2024.

All the torrent trackers of LockBit leaks are connected to:-

http://3bqptmf5ergw7mgj6jalvn5ohh2ubhssestvrwfdoubaz7nkrix4jcqd.onion:6969

Torrenting of Leaks is not a new approach as Clop Ransomware Gang had already used it earlier, back in September 2023. This helps them to club the traffic with the public and the leaked file will stay longer as it’s been shared in a decentralized fashion.

VICTIM CASE STUDY: CRINETICS

Crinetics is being listed by LockBit as the work of a shadow group or an affiliate whose data is not being claimed directly by LockBit.

On 20th March, as an Update; the group had listed 8 screenshots of the negotiation taking place between LockBit and Victim.

The demand was: $4M; but the client could pay up to $1.8M.

On April 2, as the negotiation did not turn up fruitful, the group extended its leak date to 7th April, 2024, along with an explanation stating that LockBit had terminated the communication with the victim who had provided the information to Recorded Future, which failed the instructions provided by LockBit.

Finally, LockBit affiliate closed this chapter on April 11, 2024 by increasing the ransom for Information Destruction and Data Download to $7M.

The BTC Wallets demanded for Crinetics are below mentioned:-

BTC: bc1qdtawyte5qtxgrk6far90tpeh9atfvyqgv5rcxs
XMR: 48XyFEbDz4117SopGgaSjAaMK2uXqvnmq7W2wFXKUFPJNdTLFUvgKyx82jcRiWXBDv9ojbijGYyqz9edtrsgZG9NMHG7Xff

NOTE: It is observed that the Chat Transcript of this client is purposefully put by LockBit on its Shame Page and the same is not observed for any other victims. Either this could be a warning message for the public to prove that the Negotiation takes place in Millions OR this act might not be carried out directly by LockBit but the work of an affiliate.

LOCKBIT LEAK HOSTING

The newly released data of victims (post Europol Episode) are initially hosted in Mega, instead of dedicated LockBit Data Servers as it takes more operational time to upload the databases to LockBit servers.

And later moved to their dedicated LockBit servers.

lockbit7z2jwcskxpbokpemdxmltipntwlkmidcll2qirbu7ykg46eyd.onion

lockbit33chewwx25efq6dgkhkw4u7nefudq4ijkuamjfd7x73on6dyd.onion (Downloads get pulled from here)

UNRELATED LOCKBIT DOMAIN

While analyzing the data leaks, there is a peculiarity found in the case of Pronat Industries, whose data is not hosted on regular LockBit platform.

bu27ucccflf4bkwssunbtvf6lflhp6ydvbqoxduf62ywzmpmv24wcgid.onion

It’s not a vanity TOR Domain unlike other URLs.

It can be assumed that this could be a non-LockBit affiliate or there could be a storage issue, as LockBit (or affiliates) decided to store it in a separate Onion Domain, unrelated to LockBit.

For this client, they have given BTC and XMR Addresses similar to Crinetics, however the BTC Addresses are different, but XMR remains the same.

BTC: bc1qjwquf4n0j6tc55wg9zymkas2ue484ddxtl70wv
XMR: 48XyFEbDz4117SopGgaSjAaMK2uXqvnmq7W2wFXKUFPJNdTLFUvgKyx82jcRiWXBDv9ojbijGYyqz9edtrsgZG9NMHG7Xff

A new pattern was found for the well-known targets where LockBit extends their Leak Period from 5 Days to an additional 10 days, hence delaying the leak.

LOCKBIT IMITATORS AROUND

It is found that there are various scammers around the cyber corners on various sources such as Telegram Channels, Discord Servers etc. Even sometimes, we can see Ransom Note imitating the LockBit style of attacks.

NOTE: Here, you can see that the imitator had used genuine LockBit URLs and TOX ID to show the genuinity of LockBit. But when it comes to the XMPP, the same ID is present in CryptBB Ransomware which dates back to November 2022.

Many noobs got hold of the leaked build of LockBit and weaponized it to random targets, searching to hit a jackpot. The intended targets may misidentify them as legitimate LockBit and hence may end up paying them.

Here is another chat transcript with a fake LockBitSupp on the Telegram Platform where he charges $500 as a joining fee to a private group:-

In another scenario, the victim companies that are leaked by LockBit are being re-surfaced by other groups such as “Dispossessor” by listing the same LockBit victims. Here you can see the screenshot of the same from their website:-

By observing their victim list, it is found that the group had listed 80% of clients from LockBit and also listed a few victims from 3AM and 8Base as well.

NOTE: This act indicates that there are groups who regularly download the leaks and list them after a while by launching a new website.

NOTE 2: If you want to read LockBit Imitators exclusively, I have already made a Research Article a couple of months back. You can check it out here.

LOCKBIT AFFILIATE?

While checking for the LockBit Affiliates on the Dark Web, it was found that a Russian member named “Hexonium” on a deep web forum claimed to be an affiliate of LockBit by providing the genuine Onion Domain of LockBit.

While checking the Forum activity and URL used, we can see that this member has been active since December 2023.

While navigating through the posts, we can see:-

Hexonium does not initiate/start any thread in the community and all (S)he does is interact with the breaches by posting “nigger” as a common term in all posts.

Hence we cannot rely on Hexonium as a genuine affiliate as we have seen many skids use LockBit aura to radiate the fear among the victims; especially when LockBit Black got leaked in September 2022.

NOTE: Hexonium is the name given to an In-Game Cryptocurrency, a project from Cardano. The image used by the forum user also signals the strong liking of Cardano platform by the user.

REALITY CHECK?

Here is the direct interaction with the LockBitSupp where he denies any involvement in other channels.

LEAK DATE EXTENSION: ADOPTION OF NEWER APPROACH

It is found that the group is delaying its leak from the already-set timer. This does not apply to all listed victims, however observed for a few.

Polycab is one such example where the initial leak date was April 5 but again got extended to April 22, 2024. Once the timer is set off, the data is not yet listed (ATTOW). It could have been lost during 1st batch of Operation Cronos Campaign.

Another well-known corp from India “RJCorp” is scheduled to release on April 15th, which is missing from the current list.

There are 2 possibilities for this.

Either the party had paid the ransom and their name got removed from the Data Leak Site

OR

It might be an empty threat of LockBit to inflate their victim count.

OPERATION CRONOS: PART 2

On the first week of May 2024, Europol posted the following update on the previously compromised website of LockBit:-

lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion

According to the post, the identity of LockBitSupp and other LockBit affiliates was revealed on May 7, 14:00 UTC.

As per the revelation, the identity of LockBitSupp is traced to a Russian National named “Dmitry Yuryevich Khoroshev”.

Following are the events that were observed after the LockBit Identity Reveal:-

1. Soon after this disclosure, many security researchers began to scoop up the details of the alleged member using email addresses and phone numbers shared.
2. 1 Hour after the Identity Reveal, LockBitSupp came up with the following status :-

The FBI is bluffing, I m not Dimon, I feel sorry for the real Dimon ))) oh and he will get pussy for my sins )))

3) After this status update, many in the industry started to co-relate this as a defensive approach of Khoroshev to unproven himself.

This may be true, but we never know at this moment.

4) The following day, on May 9th -> LockBit had added 77 new victims to their DLS domain. Some of the victims were re-appeared in the new batch. This could be to inflate the number of victims, hence delivering an overall impression of the high-number of single-batch infections.

5) LockBit also added a new message on DLS titled “contest.omg” where he challenged the community to communicate with Dmitry and provide evidence through their new portal.

6) The old sites (that are controlled by Feds) are being shut down now (which were active for 4 days).

LOCKBIT TOX STATUS UPDATES

Here are the important STATUS-UPDATES of LockBitSupp. Captured at different intervals:-

все на шашлындос
Everything is on the Barbeque

ФБР блефует, я не Демон, мне жаль настоящего Демона))) о, и он получит пизды за мои грехи)))
The FBI is bluffing, I m not Dimon, I feel sorry for the real Dimon ))) oh and he will get pussy for my sins )))

Придумайте как доказать, что я не Демон? Как показать всему миру что ФБР ошиблись или специально подставили Демона?
Can you figure out how to prove that I'm not a Demon? How can we show the whole world that the FBI made a mistake or deliberately framed a Demon?

участвуем в конкурсе, условия в блоге
We particiapte in the competition, conditions in the blog

CONCLUSION

When it comes to Takedowns: It is not as effective as claimed. As RaaS is a profitable business, this trend will continue. The arrest of a group paves the way for the comeback/birth of the next group with a more defensive approach.

In this case, it is not yet clear how Europol landed on Khoroshev. In short, no substantial evidence had been provided to establish an active link between Khoroshev and LockBit, but assumption of similar timelines.

At the same time, due to the secrecy of the operation, we can’t assure that Dmitry is NOT LockBitSupp.

We have to wait for a bit longer to unveil the truth as LockBitSupp has announced that it’s no more about money for them, but the victim count.

NOTE: This is a developing story and you can see the updates once I get it.

UPDATE 1

LockBit became less active for a couple of weeks, but announced the major Data Breach by listing US FEDERAL RESERVE; Central Banking System of US. The group claimed to have infiltrated about 33TB of data (which comprises Banking Information).

This turned out to be a false alarm as the data of Evolve Bank was present in the leak, which may or may not be (in)directly associated with US Federal Reserve.

The group also introduced new Onion Domain (TOR URL) recently:-

ofj3oaltwaf67qtd7oafk5r44upm6wkc2jurpsdyih2c7mbrbshuwayd.onion

UPDATE 2

LockBit group started to introduce a bunch of Mirrors for their DLS (Data Leak Site), in a series fashion.

In JULY 2024, 20 Mirror URLs are updated with Series “LBB”. We are classifying it as LBB series, as all the mirror URLs starts with “LBB”.

• lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion
• lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion
• lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion
• lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion
• lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion
• lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion
• lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion
• lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion
• lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion
• lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion
• lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion
• lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion
• lbbpoq6d2jglpw7dxarr6oaakgnlxt5nmrza5ojlufsuffuzexajsuyd.onion
• lbbuxq57hyskobn5xwtw26rkq4wyvttory6k7pio2lv5adeopeezv6ad.onion
• lbbvhambmct5s4rpf2b65mrnqynhpn4hksq47io2wow5cjtv3xmsypid.onion
• lbbw6uqp2te2f323ltn2fgwl5tu5cr3udoj3ik2obdtr5367skuh4cid.onion
• lbbw7j6si6k2bzxd4tzvesoijfjtr4pa6awqie63rmkpql7hmu6tqnqd.onion
• lbbxv6nlojheut6th4nqwpabr4gtksm7y7f4c52ubvvvumydpo4dmryd.onion
• lbbzlychkbilhjsw5hhuvk7zk4axdffy3nvel3zaqwnuo2d4nlqqkeyd.onion
• lbbzme4ctvcgzo5lq7jvcdy2v2cs6hrlgihsmylfddprzqptm6ywhhyd.onion

All these URLs are provided with a Key: “6A3OUL5IALGWJYQ2C53V7WOTVU7SKZYJ6MHXHKTLVUBPVZTEKVFA” and also guarded with Captcha to beat the bot crawlers.

In September 2024, again another set of URLs appeared, which can be classified as “LL” Series. Here are the newest URLs:-

• llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion
• llhsnvqxz5i5jkvebb2nt4l77l5cu4hd5jhpjlkj5n7ramr2z6g4kzyd.onion
• llexwrk5mcbgndt4hsni42fp76d63j2csmgrjxbk2j7yui6eov7fh2qd.onion
• lli46m2hkhiwcpbncbhlfhfh7524joc5pa66vqajgxt4vrgszwgqlhyd.onion
• llt5emrxc3h5bm6gyx2dhos2byixahhyowf3wdayan3bajmlx2etqcad.onion
• llnaqhmhysmohdiknr5tsv4vp7enbqgtjxadtrzu5mzhmdquqx7iwrqd.onion
• ll6e7r3amddyzq6t72rce6q6frdv7pi3xualapqkyppvcohhvjoynnad.onion
• lly4dbpmlg4lgsua37sqn3mdocstjuqnvdtzv7fkz7sfsfu56xahd7yd.onion
• llledlqn23uj5iothae52jvmwohytz74kn6atcjlqx6tfjwt53slf4id.onion
• llbbmmr6kgohzmiuz7h6dey5effla5d2u36xre4teh5rh2s5jmdrllyd.onion
• ll7wsjnsv23csjgaeyqjzoo6s2mhswo7ezzwyqrqbtqz6zzv4lykovqd.onion

Again these URLs are provided with the same Key: “6A3OUL5IALGWJYQ2C53V7WOTVU7SKZYJ6MHXHKTLVUBPVZTEKVFA”.

When opening a link, we can see the following new set of Victim List:-

DLS LEAK PAGE

All the leaks are hosted in the following File Servers:-

FILE SERVERS

• f4rvfhafewlxbn6scqgllbj6zmdno4rekzn5drpuh5ewipjzzt3ejcqd.onion
• lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion
• lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion
• lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion
• lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion
• lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion
• lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion
• lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion
• lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion
• lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion
• lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion

LOCKBIT 4.0 – RESURFACES WITH NEW PANELS & TOOLS

On December 19, 2024, LockBit announced a new domain on their DLS named “lockbit4.com”.

NOTE: Many people ran behind this domain on the clear-web, which was registered on 19th December 2024 from New Zealand, concealing their identity. But this domain was made out by the group to spread the word about their resurgence.

While checking the leaks, we can see the following image while opening the link:-

5 new Onion Domains are introduced by the group with new Access Key: ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA tagging it as “LockBit 4”. They are:-

• http://lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd.onion
• http://lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd.onion
• http://lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad.onion
• http://lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid.onion
• http://lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd.onion

By opening a link, we can see the following Login Portal:-

For Victims, the group had introduced 5 new Onion Domains for CHAT Support with Unique IDs:-

• lockbitspyakyequybgwgwauhzqxx7ba2gh3lmlj3zyeuaknrexdzfid.onion
• lockbitspxmqqfi6bw4y7f5psnpoaakhlisdx33busmnpgtimart5fad.onion
• lockbitspxgtf65ej7uu5h7qtephbevcsc2sk2brxzmt754etrrzhdqd.onion
• lockbitspudgjptrzadjzi7b4n2nw3yq6aqqqqw6wbrrjkr2ffuhkhyd.onion
• lockbitsptqsmaf56cmo7bieqwh5htlsfkodpahsaurxlquoz67zwrad.onion

LOCKBIT 4.0 RANSOM NOTE

Unlike previous Ransom Notes of LockBit, this time, they have made minor changes in their Ransom Note. Following is the image of Ransom Note captured:-

INSIDE LOCKBIT4.0 CHAT

The victims are welcomed with the following panel:-

The group claims to have used AES and ECC (Elliptic Curve Cryptography) Algorithms. The group does not explicitly mentioned about the algorithm, but it can be assumed that Curve25519 is being used, which is notably used by other Ransomware Groups like RansomHub, RA Group, Babuk etc.

In the chat, we can see that the group had introduced 3 new URLs dedicated for File Upload Service (Sample File Decryption) which are more than 10MB in size.

• lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion
• lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion
• lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion

💡INTELLIGENCE: LOCKBIT4.0 SAMPLES

Here I have found 2 latest samples of LockBit 4.0 during my investigation. The IOCs are in MD5 Format:-

8ff61e4156c10b085e0c2233f24e8501
1319da1523ec2a67bda016c15334c195

Following are the latest Powershell files used by LockBit Group. There is a possibility that these files would be a part of 2022 batch as some of the samples found traces back to 2022 timeline.

LBB_PS1.ps1
===========
0eff1f3ca94f1c8aeb4b720d6dd54fc3
e3a12d15768160d5c534cd99df9199e9
17a7cd1ead2d35ed5d69c71d4fd7386d
9bb6340600f80baa4eb6777266f5f0df
42cbb4743ea016868d7a049a6c9fb3fc
8015d634e9e5fd003885700bca4723d8
0552d6338817c0b5991b56527f33ad0a

LBB_PS1_obfuscated.ps1
======================
a8e97fe5a7115e42759d67f7e4d88b0d
d0457a54a4905ed5d2bb8a2b7ef7be0f

LBB_PS1_pass.ps1
================
7e525ef64a4e27fbb325d7cb4653f0a1
d96d2bcf13d55740f3bb64d45d2db94d
2b84852065e28974e4081826ff09ddc1
e0411fcbbff0e20922d224c3ac8c811e

NOTE: All these files are found on December 20, 2024. 

Following are the IPs used by LockBit 4.0 PS (Powershell) Files to communicate:-

150.171.30.10
20.101.57.9
84.201.211.40
23.54.127.209
64.233.181.94
199.232.210.172
184.28.89.167 
20.12.23.50
184.30.21.171
40.69.42.241

💡LOCKBIT 5.0: ANNOUNCEMENT

The group had announced their 5th Version of LockBit on 6th Anniversary of LockBit Ransomware Group on 3rd August 2025. The group had earlier discussed about this update on their RAMP Forum a few months back.

Their new vanity domain is tied with FBI:-

lockbitfbinpwhbyomxkiqtwhwiyetrbkb4hnqmshaonqxmsrqwg7yad.onion

In this Vanity TOR Domain, you can see the group had purposefully put “Lockbit” and “FBI” together to openly challenge them.

It is also found that the domain is undergoing a DDOS Attack in the mean time.

Other new TOR Domains found are:-

• lockbitapt67g6rwzjbcxnww5efpg4qok6vpfeth7wx3okj52ks4wtad.onion
• lockbitsuppyx2jegaoyiw44ica5vdho63m5ijjlmfb7omq3tfr3qhyd.onion

However, it is important to note that these newly set domains are not linked to the legacy TOR Domains of LockBit Ransomware, except the inclusion of same TOX ID.

Moreover, the DLS does not display any new victims from LockBit Group since April 2025. And the main DLS remains offline sometimes.

This indicates that LockBit 5.0 could be another gang impersonating LockBit or a honey-trap set-up by FBI to tail the Affiliates.

LOCKBIT5.0 SAMPLE ANALYSIS

While observing the samples of LockBit5.0, an interesting fact found. Most of the samples share a similar VHash. This indicates Identical builder and same builder configuration (same embedded config, same compilation options, same stub, same packer settings, same encryption keys placeholder, etc) are used to generate the samples. Only the final encryption key or a tiny mutable field was inserted later (or not at all yet).

They will encrypt the same way, drop the same ransom note, contact the same C2 domains (or have the same placeholder), use the same extension, etc.

Following are the list of LockBit5.0 Samples identified along with VHash Value:-

MD5 : VHASH

• e47032b3d1b9cbbcf77741d5d260004d : 016056657d15151″z
• f79ea684b3d459cf3f9d93dac0818ad5 : 016056657d15151″z

• 5e1f61b9c1c27cad3b7a81c804ac7b86 : 075056657d15151″z
• 1fbb3d049da3a766b37fa234b8ca7c39 : 075056657d15151″z
• 8f718979876dd1050ce4f729d69e0072 : 075056657d15151″z
• 95daa771a28eaed76eb01e1e8f403f7c : 075056657d15151″z
• 5e1f61b9c1c27cad3b7a81c804ac7b86 : 075056657d15151″z

• c462c6b02b35df2910689947c5090fae : 056056657d15151″z

While analyzing the VHash, another interesting fact found. All VHash starts with “0”.

VHashes of LockBit5.0 are identical except first 3 bits. Rest are followed by: 056657d15151″z which is same. This is same for all the 8 samples identified. 

USES OF VHASH IN THREAT HUNTING

📌This would help to eliminate False Positives while analyzing the samples at bulk
📌No need to analyze multiple samples with same VHash
📌Also helps to identify LockBit 5.0 Samples though the Creation Time is altered
📌This also helps to identify if any project got forked/mirrored blindly

You can view my GitHub Account for more info. Another repo here.

LOCKBIT 5.0 VICTIMS ANNOUNCED

On December 4, 2025; the group had listed 23 Victims on their newly announced DLS.

Out of 23 Victims listed, 10 victims are from previous batch with the timeline of Early 2025 (April).

Among this, 1 is claimed by Weyhro Ransomware and another one from RansomHouse Ransomware earlier.

All victims are having a countdown timer with 15 Day before the official leak.

LOCKBIT 5.0: EXPOSING REAL IP

Upon digging deep, I came across the real IP used by LockBit 5.0 Group which is hosted with AS53667 (PONYNET).

• 205.185.116.233

Upon further scan, a domain is also found to be displaying the same LockBit 5.0 Logo with same DDOS Message as shown above.

• karma0.xyz

The above domain is registered on 2nd November 2025, as we can see the group had resumed their activities after a short silence.

It is also found that Lockbit Group had used Smokeloader in their attacks. Below is the Hash of the Smokeloader used by Lockbit Group:-

• MD5: e818a9afd55693d556a47002a7b7ef31

LEAK CLAIMS ANALYSIS

While checking 39 victims listed (as of 7th December 2025), it is found that there are 11 are recycled from Early 2025 LockBit leaks. They are:-

• Crystal-D
• Vision Products
• KLL-Law
• Hennessy Funds
• Graphique de France
• AQHCH
• Fepasa
• Grupotersa
• Bioclima
• Ende
• AEAMG

Some of the X-claims (Cross Claims) includes:-

• Terra Carribean: Weyhro
• Intellion: RansomHub
• Cadopt: BianLian
• Marriott: Conti

LOCKBIT 5.0 RESPONSE

Soon after the exposure of real IP, the group was frustrated and displayed the message as following:

Ofcourse, they are not happy about my finding! 🙂

They also displayed a Comic Horror GIF on their exposed Clear Web Domain too!

LOCKBIT 5.0 DATA LEAK : VIA TORRENT

On 18th December 2025, LockBit 5.0 began to leak the listed victims via Torrent Network. It is notable that the group had made use of same network peers via P2P Sharing. 

Some of the notable IPs are:

31.200.249.130
31.200.249.146
31.200.249.162
31.200.249.178
31.200.249.227
31.200.249.231
31.200.249.233
31.200.249.237
185.183.34.95
185.191.59.69

LockBit continues to serve the Data Leaks via same Servers which were active a couple of months back! All the IPs recorded are from Russia 🇷🇺

Interestingly, Cl0p Ransomware group also makes use of same network for their Data Leaks (via Torrent). Out of 9 above mentioned IPs, 5 are overlapped with Clop Ransomware 0-Day EBS Data Leak Batch. This strongly suggests that a shared network (for Torrent) is seen among Ransomware Groups.

Based on the repeated Torrent (P2P) Seeds, it can be confirmed that ASN 216158 Teleport Rus LLC is a major player in hosting Data Leaks of the group.

LOCKBIT ANNOUNCED NEW TOR DOMAINS FOR TORRENT

Lockbit Ransomware Group creates several Onion TOR Domains for serving Victim Data Leaks as the leaks are large-sized which are often impossible to download at a single-go. 

This is a trend which has been active since Lockbit 3.0 where the group creates 10 Vanity TOR Onion Domains with keyword “lockbit” to serve the Victim Breach via Torrent downloads. 

Following is the set of Onions created by LockBit 5.0 group to channelize data breaches. 

This same Modus Operandi has been spotted in April 2024; when LockBit group was running LockBit 3.0 version. 

A batch of 10 TOR Onion Domains are created to share the leaks. In 2025; we have found 2 batches of Torrent Domains created by the group.

Here is the list of TOR Onion Domains created exclusively for Torrent (P2P) Share Network:

LOCKBIT 5.0
===========
BATCH - 1
lockbitynxdcxtuvma5deq5pxtnqoacftuigkk37xjq3whefozdpcuad.onion
lockbity44loulvujiaoels7knti2tfsnglclnse22syaa6x3vpqp7yd.onion
lockbitqth2ij5cdqmj4cdchoh3etnlbh74utqviwqb5svvhxygnmoqd.onion
lockbitotfzuq2lpyydzgbhelps2mcz62cpix4nzpcyaak5444iwfmqd.onion
lockbitgf43c7avhx5wesx5ambjgbormhwc2tujsy6lvg6drkjhnjryd.onion
lockbitfnszjao7hayqsd424m74k5jxc52hozvabjrut7pjfsfaaaoad.onion
lockbitdzdbv5dh6ncf65c22tdgej72sty6ikiieuinibh6icnzrv4yd.onion
lockbitbgtyqtgutvasrld5gx23ozo32y4xkjrby6bte3zyvjdlyoxyd.onion
lockbitabmbzz652qeqd7yztgugcihpy4s4f6zuqi3jx32rzjylsn7ad.onion
lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion

BATCH - 2
lockbityq64mwtobqqcr3iwxs5q4o7iliuv72gbx4vflggj4m4wqekad.onion
lockbity3v2rhjjjt6opcgvdrrlvdbrt3p2wqmxmq4cm36cchphdy6qd.onion
lockbitnpobu6luzzlxb7br5uyqnmeruwimpjuw2kv442nvxd6sufsad.onion
lockbitkybiqhyv64vdaamz7uf2ymjoafyalx3e6spmmsz5xyk5nbcad.onion
lockbitjqfuyrkxiie6bcly6ow4sh6lmyuyvyats5hcpe5e6hbuhikyd.onion
lockbithn5a2qgf4ojvut3q25yylrauvjxrz6sjdd4teas65osru2lqd.onion
lockbitf75dfwq4bsec3iaytf6z5z6dmstx3g35grn74ndxy3py2ozyd.onion
lockbitdx4kanolaotenc3nmonlxv5enmhxdh2lk54rirvcdsljfbjyd.onion
lockbit7tnu7whmaqnnlmvnoxzejssvr6vkcoovg35encvnp24pikvyd.onion
lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion

LOCKBIT 3.0
===========
lockbity7oz7kjcdcgacvihhsli6oimuodmmaftw5omdpgscxdc3mhid.onion
lockbitwnklgh3lt6umrbiztgzl6qujtovdtcovdjhavepp7bpvcmfid.onion
lockbitst7jglgbsj7aijbiqvxwmlhcs7e7gb3eeqx7rjtxsjklw4yyd.onion
lockbitnthkolp2mfa5byjrx2mcbleruktoiawsprqrducnrzilchjid.onion
lockbitjvv72zmzgcqgn63ehjaapffubbwjwi32gzdbrahxjy3hzrxid.onion
lockbitbuy3gsqwrgavmi3ehlmk26h6g3aeyslnq4yksjcbpt6ij5cqd.onion
lockbit33chewwx25efq6dgkhkw4u7nefudq4ijkuamjfd7x73on6dyd.onion
lockbit7gtvdkx7j3tyfpw43zv6majh2owrsp3zilhpm36a3fldqtyqd.onion
lockbit3m6lgexvokfxyqcdnykdvhye7aftic6p4uh7mnz42h25ooiid.onion
lockbit2zfxali5yrplh5swimxva5o4xqi3zpbc24tczgffxh7msrvyd.onion

One interesting fact here is: though the seeds/peers are less, it is hard to download the entire database via Torrent (P2P Share) Network.

But the group is smart enough to publicize the entire data via other methods such as: dumping entire data (folder wise) like this:-

Here, you can see 3 ways of sharing data:-

• Direct Download: Only possible in case of High-Speed Internet
• Torrent Download: Less approachable due to lack of Seeds/Peers
• Folder Explore: Free Scouting, Optimal Use 

And if anyone needs to pin-point a specific file; it’s easily accessible directly from Folder Explore (Unpack) option such as:

All these data are stored in:- 

lockbit24pegjquuwbmwjlvyivmyaujf33kvlepcxyncnugm3zw73myd.onion

Here, we have noticed the group is aggressively using various methods to leak the data in a customizable manner. The user is free to choose the method to obtain the data. 

PANEL INFILTRATION

On 14th January 2026; Security Researcher Matthew Maynard was able to access the panel of Lockbit 5.

While inspecting panel, found following info:

Here, it is evident that the group maintains 4 versions of LockBit Variants namely:- ChuongDong, Black, Linux and ESXi.

Additionally a Chat ID is also present to generate a chat with victims as well as Admin.

Another Researcher Arda Büyükkaya managed to obtain the panel and generate few LockBit 5 samples on the fly.

Some of the samples generated from ChuongDong Variant:

Here is another set of samples generated of LB Linux variants:

STAY TUNED FOR MORE UPDATES!!!

GENERAL IOCs

TOR DOMAINS
===========

lockbit7z2jwcskxpbokpemdxmltipntwlkmidcll2qirbu7ykg46eyd.onion
lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion
lockbit7z2og4jlsmdy7dzty3g42eu3gh2sx2b6ywtvhrjtss7li4fyd.onion
lockbit7z2mmiz3ryxafn5kapbvbbiywsxwovasfkgf5dqqp5kxlajad.onion
lockbit7z355oalq4hiy5p7de64l6rsqutwlvydqje56uvevcc57r6qd.onion
lockbit7z36ynytxwjzuoao46ck7b3753gpedary3qvuizn3iczhe4id.onion
lockbit7z37ntefjdbjextn6tmdkry4j546ejnru5cejeguitiopvhad.onion
lockbit7z3azdoxdpqxzliszutufbc2fldagztdu47xyucp25p4xtqad.onion
lockbit7z3ddvg5vuez2vznt73ljqgwx5tnuqaa2ye7lns742yiv2zyd.onion
lockbit7z3hv7ev5knxbrhsvv2mmu2rddwqizdz4vwfvxt5izrq6zqqd.onion
lockbit7z3ujnkhxwahhjduh5me2updvzxewhhc5qvk2snxezoi5drad.onion
lockbit7z4bsm63m3dagp5xglyacr4z4bwytkvkkwtn6enmuo5fi5iyd.onion
lockbit7z4cgxvictidwfxpuiov4scdw34nxotmbdjyxpkvkg34mykyd.onion
lockbit7z4k5zer5fbqi2vdq5sx2vuggatwyqvoodrkhubxftyrvncid.onion
lockbit7z4ndl6thsct34yd47jrzdkpnfg3acfvpacuccb45pnars2ad.onion
lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad.onion
lockbit7z57mkicfkuq44j6yrpu5finwvjllczkkp2uvdedsdonjztyd.onion
lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd.onion
lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd.onion
lockbit7z5ltrhzv46lsg447o3cx2637dloc3qt4ugd3gr2xdkkkeayd.onion
lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid.onion
lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd.onion
lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd.onion
lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd.onion
lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd.onion
lockbitfilzhrvt6eya2lvnp7te4iifzmwybendqclgujqbzu3k4gaid.onion
lockbitfilzu5e62fybhieutf6653cpv6wco7twgjtkqwdgubn4q5rad.onion
lockbitfile2tcudkcqqt2ve6btssyvqwlizbpv5vz337lslmhff2uad.onion
lockbit33chewwx25efq6dgkhkw4u7nefudq4ijkuamjfd7x73on6dyd.onion
3bqptmf5ergw7mgj6jalvn5ohh2ubhssestvrwfdoubaz7nkrix4jcqd.onion ofj3oaltwaf67qtd7oafk5r44upm6wkc2jurpsdyih2c7mbrbshuwayd.onion

Old LockBit TOR Domains
=======================
lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion
lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion
lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion
lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion

BTC Wallets
===========
bc1qdtawyte5qtxgrk6far90tpeh9atfvyqgv5rcxs
bc1qjwquf4n0j6tc55wg9zymkas2ue484ddxtl70wv

XMR: 48XyFEbDz4117SopGgaSjAaMK2uXqvnmq7W2wFXKUFPJNdTLFUvgKyx82jcRiWXBDv9ojbijGYyqz9edtrsgZG9NMHG7Xff

IP: 5.182.5.126

TOX: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7

EXTRA READING

If you are an avid reader of LockBit Story, here you can read few resources which I personally liked:-

https://krebsonsecurity.com/2024/05/how-did-authorities-identify-the-alleged-lockbit-boss/
https://analyst1.com/ransomware-diaries-volume-5-unmasking-lockbit-2/
https://therecord.media/lockbitsupp-interview-ransomware-cybercrime-lockbit

NOTE:- The article is purely Individual Research and is not subjected to be used/published anywhere without the Author’s consent.