Ransomware Intelligence / Groups / lockbit5

Ransomware group

lockbit5

  • 10claims, 7 days
  • 22claims, 30 days
  • 64claims, 90 days
  • 2026-08-02first seen
  • 2026-10-15last seen

These are claims posted by the group on its leak site, counted when we first see them. They are not confirmed incidents, and we never name a victim.

Activity, last 26 weeks

New leak-site claims per week.

Week of 2026-04-20: 0Week of 2026-04-27: 0Week of 2026-05-04: 0Week of 2026-05-11: 0Week of 2026-05-18: 0Week of 2026-05-25: 0Week of 2026-06-01: 0Week of 2026-06-08: 0Week of 2026-06-15: 0Week of 2026-06-22: 0Week of 2026-06-29: 0Week of 2026-07-06: 0Week of 2026-07-13: 0Week of 2026-07-20: 0Week of 2026-07-27: 9Week of 2026-08-03: 1Week of 2026-08-10: 5Week of 2026-08-17: 4Week of 2026-08-24: 6Week of 2026-08-31: 9Week of 2026-09-07: 5Week of 2026-09-14: 5Week of 2026-09-21: 4Week of 2026-09-28: 3Week of 2026-10-05: 5Week of 2026-10-12: 8
Claims per week, oldest to newest. Each bar is a full Monday-to-Sunday week; the newest bar is the current week so far.

Sectors claimed, last 90 days

  1. Professional services 16
  2. Manufacturing 12
  3. Financial services 8
  4. Healthcare 5
  5. Retail 5
  6. Technology 4
  7. Unclassified 3
  8. Government 3
  9. Critical infrastructure 2
  10. Construction 1
  11. Hospitality 1
  12. K-12 education 1
  13. Nonprofit 1
  14. Other 1
  15. Transportation and logistics 1

Countries claimed, last 90 days

  1. United States 13
  2. Netherlands 7
  3. Unknown 5
  4. Brazil 5
  5. France 5
  6. Italy 4
  7. Argentina 3
  8. India 3
  9. Germany 2
  10. Australia 1
  11. Belgium 1
  12. Chile 1
  13. Czechia 1
  14. Egypt 1
  15. ET 1

Vulnerabilities with known ransomware use

From CISA's Known Exploited Vulnerabilities catalog, newest first. The catalog does not attribute entries to a specific group; this is the current patch list for any ransomware operator.

Added CVE Vendor / product Vulnerability
2026-08-18 CVE-2026-59310 Broadcom VMware vCenter Broadcom VMware vCenter Path Traversal Vulnerability
2026-08-05 CVE-2026-63077 JetBrains TeamCity JetBrains TeamCity Deserialization of Untrusted Data Vulnerability
2026-07-29 CVE-2026-20316 Cisco Secure Firewall Management Center (FMC) Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability
2026-07-14 CVE-2026-15410 SonicWall SMA1000 Appliances SonicWall SMA1000 Appliances Code Injection Vulnerability
2026-07-14 CVE-2026-15409 SonicWall SMA1000 Appliances SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
2026-07-01 CVE-2026-45659 Microsoft SharePoint Server Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability
2026-06-25 CVE-2026-12569 PTC Windchill and FlexPLM PTC Windchill and FlexPLM Improper Input Validation Vulnerability
2026-06-12 CVE-2026-35273 Oracle PeopleSoft Enterprise PeopleTools Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability

Data sources

  • Source: CISA KEV
    updated 2 hours ago
  • Opening demands are read from leaked ransomware negotiation chats collected by Ransomchats (MIT licence), using an OpenAI language model. These chats are not a representative sample.
    updated 2 hours ago
  • Source: RansomLook
    updated 2 hours ago
  • Sector, country and region labels are inferred by SecuritySnares from the published organisation name using an OpenAI language model; treat them as estimates.
    updated 2 hours ago

Leak-site listings reflect claims by threat actors and are not independently verified. Victims are never named on this site unless they have disclosed the incident themselves. Read the methodology.