19 Shades of LockBit5.0, Inside the Latest Cross-Platform Ransomware: Part 1

Summary

The article reviews 19 LockBit 5.0 ransomware samples built to hit Windows, Linux, and VMware ESXi. It emphasizes fast encryption using ChaCha20, the family’s cross-platform design, and ESXi-focused behavior that can power down virtual machines before encrypting their disks. The write-up walks through execution stages, anti-analysis measures, and the hypervisor-specific file targets the malware prioritizes during impact.

Investigation

Researchers conducted static analysis of the ELF variants, extracting embedded paths, command strings, and configuration switches. On ESXi, the malware leverages VMware management tooling (including vim-cmd) to enumerate and shut down VMs ahead of disk encryption, and includes anti-debug checks for tools like valgrind and frida. The sample writes execution telemetry to /var/log/encrypt.log and supports self-deletion after completing its routine.

Mitigation

Monitor ESXi hosts for unexpected use of VMware administrative commands, unplanned VM shutdown events, creation of /var/log/encrypt.log, and artifacts such as .vmdk.fastpass markers. Reduce exposure by preventing untrusted ELF execution on hypervisors and enforcing strict allow-listing for binaries and scripts permitted to run on ESXi.

Response

If activity is detected, isolate the affected ESXi host, halt VM processes to contain spread, and preserve forensic evidence (the ELF payload, encrypt.log, and relevant host logs). Begin recovery from verified clean snapshots/backups, then sweep for additional ransomware components and validate the integrity of critical hypervisor files.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:
  An attacker with administrative access to the ESXi host uploads the LockBit 5.0 payload via the vSphere client. The ransomware creates its working directory under /var/tmp/.guestfs-0/appliance.d/root, writes an encryption log to /var/log/encrypt.log, and begins traversing all VMFS datastores (/vmfs/volumes/) to encrypt virtual disk files. The following commands emulate that behavior using harmless dummy files:

  1. Create the ransomware staging directory and a dummy “encrypted” VMFS file.
  2. Write a log entry that mimics LockBit’s encryption status.
  3. Touch a file deep inside a VMFS volume to replicate bulk encryption activity.

• Regression Test Script:

  #!/usr/bin/env bash
  set -euo pipefail
  
  # 1️⃣ Create staging directory (simulates LockBit payload unpack)
  mkdir -p /var/tmp/.guestfs-0/appliance.d/root
  echo "LockBit 5.0 staging directory created" > /var/tmp/.guestfs-0/appliance.d/root/stage.txt
  
  # 2️⃣ Write an encryption log (simulates ransomware activity logging)
  LOGFILE="/var/log/encrypt.log"
  echo "$(date '+%Y-%m-%d %H:%M:%S') - Encryption started on VMFS datastore" | sudo tee -a "$LOGFILE"
  
  # 3️⃣ Simulate bulk file encryption on a VMFS volume
  DUMMY_VMFS_PATH="/vmfs/volumes/lockbit_simulation"
  mkdir -p "$DUMMY_VMFS_PATH"
  dd if=/dev/zero of="$DUMMY_VMFS_PATH/encrypted_dummy.vmdk" bs=1M count=10 status=none
  echo "Dummy VMFS file created to emulate ransomware encryption" | sudo tee -a "$DUMMY_VMFS_PATH/notes.txt"
  
  echo "=== Simulation complete. ==="

  Run the script as root (or via sudo) on the ESXi host. The auditd watches will generate open, write, and creat events that match all keywords in the Sigma rule.

• Cleanup Commands:

  #!/usr/bin/env bash
  set -euo pipefail
  
  sudo rm -rf /var/tmp/.guestfs-0/appliance.d/root
  sudo rm -f /var/log/encrypt.log
  sudo rm -rf /vmfs/volumes/lockbit_simulation
  
  echo "=== Cleanup complete. ==="