lockbit5
First seen December 4, 2025Active426 claimed victims
The claims below are reproduced as posted by lockbit5 on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
LockBit 5.0 ("ChuongDong") emerged in September 2025 as the group's resurgence following the February 2024 law enforcement takedown, introducing cross-platform payloads targeting Windows, Linux, and VMware ESXi with enhanced evasion capabilities and continuing the RaaS affiliate model of its predecessors.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| aqhch.com.cn | April 12, 2025 | ransomware_live | — |
| anwalt-austria.at | April 12, 2025 | ransomware_live | — |
| behranlift.com | April 12, 2025 | ransomware_live | — |
| carseo.de | April 12, 2025 | ransomware_live | — |
| gumustasmaden.com.tr | April 11, 2025 | ransomware_live | — |
| graphiquedefrance.com | April 6, 2025 | ransomware_live | — |
| visionproducts.llc | April 5, 2025 | ransomware_live | — |
| ende.bo | April 4, 2025 | ransomware_live | — |
| aeamg.org.br | March 31, 2025 | ransomware_live | — |
| physiciansmedicalbilling.net | March 31, 2025 | ransomware_live | — |
| intellioan.com | March 30, 2025 | ransomware_live | — |
| hennessyfunds.com | March 30, 2025 | ransomware_live | — |
| grupotersa.com.mx | March 15, 2025 | ransomware_live | — |
| fepasa.com.ar | March 7, 2025 | ransomware_live | — |
| crystal-d.com | March 7, 2025 | ransomware_live | — |
| asiapacificex.com | March 7, 2025 | ransomware_live | — |
| terracaribbean.com | February 27, 2025 | ransomware_live | — |
| brumfieldconstructioninc.com | February 26, 2025 | ransomware_live | — |
| 51talk.com | January 30, 2025 | ransomware_live | — |
| topackt.com | January 23, 2025 | ransomware_live | — |
| jobberswarehouse.com | January 10, 2025 | ransomware_live | — |
| gob.mx | November 15, 2024 | ransomware_live | — |
| fortishealthcare.com | October 28, 2024 | ransomware_live | — |
| arc-com.com | September 9, 2024 | ransomware_live | — |
| aerworldwide.com | August 17, 2024 | ransomware_live | — |
| rdmetals.nl | April 17, 2023 | ransomware_live | — |
← NewerPage 5 of 5
Claim data from ransomware.live and RansomLook (CC BY 4.0).