Researchers published a technical analysis of 19 samples of LockBit 5.0 on Trend Micro covering Windows, Linux (LINUX Locker v1.06/v1.08), and ESXi (LINUX ESXi Locker v1.07) variants of the latest LockBit ransomware family. The samples achieved a detection score of 1/65 on VirusTotal at time of analysis. A key architectural shift from prior versions is the replacement of AES-based encryption with the ChaCha20 stream cipher — a faster, library-independent implementation that complicates signature-based detection while maximizing encryption throughput across large enterprise environments.
LockBit's Evolving Business Model: RaaS to Cartel
LockBit operates as a ransomware-as-a-service (RaaS) ecosystem: a core team develops and maintains the malware, negotiation infrastructure, and leak site, while affiliates conduct intrusions and deployments for a revenue share. Reporting from October 2025 describes LockBit aligning with other ransomware brands including DragonForce and Qilin in a cartel-style model emphasizing shared resources and affiliate pooling. If this umbrella structure matures, defenders may face not a single prolific RaaS brand but an aggregation layer pooling affiliates, infrastructure, and playbooks across multiple ransomware operations simultaneously.
ESXi Variant: Automated VM Shutdown Before Encryption
The ESXi variant is a 64-bit Linux ELF (x86-64) dynamically linked binary that deliberately omits ELF section headers — a common anti-analysis technique that reduces the effectiveness of automated triage workflows. Execution begins with an OS validation via vmware -v 2>/dev/null to confirm the ESXi environment. The malware then enumerates running VMware virtual machine processes using a ps | grep vmx pipeline to extract PIDs, then iterates through each VM issuing vim-cmd vmsvc/power.off commands in a verified loop — confirming each VM is fully powered off before proceeding. This automated shutdown releases file locks on virtual disk files, allowing the ransomware to encrypt the underlying VMDK and configuration data powering the entire virtual infrastructure simultaneously. Real-time operational metrics are maintained throughout to provide operators with encryption progress visibility.
Command-line options expose a highly configurable execution model: fast encryption mode, background execution, quiet mode, note storage behavior, self-destruction control, free space wiping, and custom encryption percentage parameters allow operators to tune each deployment for speed versus thoroughness.
ESXi i386 Variant: LINUX Locker v1.06 with Poly1305 and Rotate-Based String Obfuscation
A 32-bit ELF (i386) variant labeled "LINUX Locker v1.06" shares identical orchestration with the x64 ESXi sample — hardcoded datastore traversal under /vmfs/volumes/ and vim-cmd integration — but is stripped and also omits the section header table. High-value strings including paths, command templates, and operational messages are obfuscated behind a runtime rotate-based transform decoded on demand. The cryptographic stack includes ChaCha-family cipher implementations alongside Poly1305 authentication, concurrent processing via threading and TLS state management.
ChaCha20: Replacing AES Across All Platforms
The ChaCha20 stream cipher implementation is consistent across all 19 analyzed samples. The state initialization uses the standard constant string "expand 32-byte k" (identifiable from the little-endian hex representation in memory), confirming a custom implementation of the RFC 7539 ChaCha20 specification rather than a library call — avoiding detection by security tools monitoring standard cryptographic library usage. The shift from AES (used in LockBit 3.0/Black) to ChaCha20 prioritizes throughput for large-scale ESXi and Linux filesystem encryption scenarios where processing speed directly determines operational impact before detection and response can intervene.