LockBit strikes with new 5.0 version, targeting Windows, Linux and ESXI systems

MITRE Techniques

• [T1055 ] Process Injection – Uses process hollowing/injection by launching a legitimate process suspended, writing the LockBit image into its memory, setting a new thread context and resuming execution (‘Defrag.exe — a system utility responsible for defragmentation — will be started in a suspended state. … Right before writing, we can observe the ‘MZx’ header in the buffer, which is actually the image of LockBit. After that, it sets a new thread context, resumes it and terminates execution.’)
• [T1027 ] Obfuscated Files or Information – Binaries are packed or have encrypted strings and use MBA obfuscation around return‑address dependent hashes to hinder analysis (‘This includes packing, DLL unhooking, process hollowing, patching Event Tracing for Windows (ETW) functions and clearing all available logs in the system.’ and ‘almost all strings are encrypted.’)
• [T1562 ] Impair Defenses – Modifies or disables telemetry by patching ETW functions to prevent security software from tracing events (‘it patches the ‘EtwEventWrite’ function… replaces the very first byte in this function with the value ‘C3’, which is a ‘return’ instruction in assembly.’)
• [T1070.001 ] Indicator Removal on Host – Clear Windows Event Logs using EvtClearLog to remove trace evidence after execution (‘clears all available event logs by passing different service log files to the ‘EvtClearLog’ function.’)
• [T1070.004 ] Indicator Removal on Host – File/self deletion via SetInformationByHandle FileDispositionInfo to delete the malware binary after execution (‘calls the ‘SetInformationByHandle’ function… with flag 4 (FileDispositionInfo). Passing value ‘1’ will trigger file deletion.’)
• [T1486 ] Data Encrypted for Impact – Encrypts victim files with XChaCha20 for symmetric and Curve25519 for asymmetric operations, appending encrypted keys and random extensions to each file (‘All versions have the same ransom note, append a random extension to each encrypted file, and the same encryption routine that involves XChaCha20 and Curve25519.’)
• [T1485 ] Data Destruction – Performs free‑space wiping by creating a temporary file and writing zeros until free space is exhausted to hamper recovery (‘it will create a ‘.tmp’ file in C: drive and start writing ‘00’ bytes to it, 4194304 bytes per write until the free space ends.’)
• [T1041 ] Exfiltration Over C2 – Implements double‑extortion by exfiltrating files to attacker servers prior to or alongside encryption to pressure victims (‘also exfiltrating files to the attacker’s server to increase the likelihood of receiving the ransom.’)
• [T1497 ] Virtualization/Sandbox Evasion – Detects analysis environments and known debuggers/trace tools and exits if detected to avoid analysis (‘To avoid analysis, it gets the parent process name, decodes saved values and compares them. If matches, it will terminate execution.’ and lists gdb, lldb, strace, ltrace, rr.)
• [T1036 ] Masquerading – Attempts to appear legitimate by using a fake compilation timestamp and a suspicious/invalid certificate to evade casual inspection (‘The LockBit 5.0 Windows sample is a PE64 file with a fake compilation timestamp… This file has an invalid certificate that expired in 1996 and was issued to the BorgWarner company.’)