Ransomware group
Lockbit5 ransomware: victims and leak site activity
The Lockbit5 ransomware group has listed 390 victims on its leak site since December 2025; its latest post is from 23 October 2026. Most affected countries: United States, Italy and Brazil. Most targeted sector: Professional Services.
Total posts
390
First seen
2025-12-07
Latest post
2026-10-23
Countries hit
74
About Lockbit5
LockBit 5.0 ("ChuongDong") emerged in September 2025 as the group's resurgence following the February 2024 law enforcement takedown, introducing cross-platform payloads targeting Windows, Linux, and VMware ESXi with enhanced evasion capabilities and continuing the RaaS affiliate model of its predecessors.
- Leak site (Tor)
- http://lockbitapt67g6rwzjbcxnww5efpg4qok6vpfeth7wx3okj52ks4wtad.onion
- Profile
- ransomware.live
Most targeted countries
- United States 70
- Italy 31
- Brazil 30
- Germany 27
- Mexico 17
- France 14
- Netherlands 14
- Spain 9
- India 9
- Thailand 9
Most targeted sectors
- Professional Services 67
- Manufacturing 64
- Technology 48
- Healthcare 35
- Agriculture and Food Production 26
- Retail & E-Commerce 26
- Education 21
- Government & Defense 16
- Hospitality 16
- Financial Services 14