LockBit 5.0 is still actively hitting organizations worldwide, and the group's affiliates have refined their approach into a two-pronged attack that's proving difficult to fully defend against. According to recent threat intelligence, LockBit 5.0 double extortion campaigns now rely less on brute-force encryption alone and more on a calculated combination of data theft and disruption designed to maximize pressure on victims to pay.

This isn't a new ransomware family springing up out of nowhere. LockBit has a long, well-documented history as one of the most prolific ransomware-as-a-service operations in the world, and its resurgence after law enforcement's Operation Cronos takedown effort has been closely tracked by security researchers. For readers who want the fuller backstory on how the group rebuilt itself and evolved into its current form, our LockBit 5.0 explainer covers that history in depth. This piece focuses on what's happening right now: the mechanics of the current campaign and what organizations can do about it.

How LockBit 5.0's Double-Extortion Attack Works

The attack pattern affiliates are using follows a deliberate sequence. Before any files get encrypted, attackers first exfiltrate data from the target network using tools like Rclone, a legitimate file-transfer utility that's been repurposed for quietly moving large volumes of stolen data to external storage, or custom-built stealer malware designed specifically for the job.

Only after that data has been copied out does the encryption phase begin, and it's designed to be fast. Affiliates use rapid, intermittent encryption routines, meaning files are locked in bursts rather than all at once in a single continuous process. This approach lets attackers encrypt large numbers of files quickly while making detection by traditional monitoring tools harder. Encrypted files are also given randomized file extensions, which complicates recovery efforts and makes it more difficult for defenders to quickly identify the scope of what's been affected.

The result is a double bind for victims. Even if an organization can restore encrypted systems from backups and avoid paying for a decryption key, the attackers still hold stolen data and can threaten to leak or sell it. That second lever is precisely why this model has remained effective for ransomware groups across the industry, and why LockBit's affiliates continue leaning on it across Windows, Linux, and virtualized environments.

Why Data Exfiltration Is Now the Real Threat, Not Just Encryption

It's tempting to think of ransomware primarily as a file-encryption problem, something you solve by keeping good backups. That thinking misses where the actual leverage now sits. Once data has left the network, backups don't undo the exposure. Stolen files, whether they're customer records, financial data, internal communications, or intellectual property, are already in the attackers' hands regardless of whether the victim organization ever pays the ransom.

This shift matters because it changes what "recovery" actually means. Restoring systems from a clean backup addresses operational downtime, but it does nothing to prevent sensitive information from being published on a leak site or sold to other threat actors. Organizations need to treat data exfiltration as the primary risk to plan for, not an afterthought to encryption.

Hardening Steps: Backups, Segmentation, and Access Controls

Given this attack pattern, a few defensive priorities stand out as particularly relevant to how LockBit 5.0 affiliates operate:

  • Encrypted, offline backups. Backups should be encrypted at rest and kept isolated from the primary network, ideally with immutable or air-gapped copies, so that even if attackers gain broad access, they can't reach or tamper with recovery data.
  • Network segmentation. Because affiliates move data out before encrypting, limiting how far an intruder can travel across a network once inside reduces both the volume of data at risk and the number of systems that can be hit in the encryption phase.
  • Monitoring for unusual data transfers. Since exfiltration tools like Rclone are legitimate software being misused, security teams should watch for anomalous outbound transfer volumes or unfamiliar use of file-sync utilities, not just malware signatures.
  • Strict access controls. Limiting which accounts and systems can access sensitive data reduces the pool of information available to steal even if an attacker compromises a foothold account.
  • Incident response planning that assumes data theft. Response plans should explicitly account for the possibility that data was copied out before any encryption was detected, so legal, communications, and regulatory obligations aren't an afterthought.

None of these measures are exotic. What matters is applying them with the specific LockBit 5.0 pattern in mind: fast, intermittent encryption preceded by quiet data theft.

What This Means For You

If you run IT or security for an organization of any size, the practical takeaway is that ransomware defense can't stop at encryption prevention. A LockBit 5.0 double extortion event succeeds even against organizations with solid backup practices, because the theft happens first and the leverage doesn't depend on encryption alone. Reviewing how sensitive data is segmented, who can access it, and whether outbound transfers are being monitored is at least as important as backup hygiene at this point.

For individuals, the exposure is more indirect but still real. If a company you've shared personal data with is hit by this kind of campaign, your information could end up exposed regardless of whether that organization pays a ransom. It's a good reminder to be selective about what personal data you share with services and to keep an eye out for breach notifications tied to companies you use.

Key Takeaways

LockBit 5.0's continued activity is a reminder that ransomware-as-a-service operations adapt quickly, and defenses need to keep pace. To reduce risk from this kind of campaign:

  • Maintain encrypted, offline or immutable backups that attackers can't reach or corrupt
  • Segment networks so a single compromised account can't reach the entire environment
  • Monitor for unusual outbound data transfers, not just malware signatures
  • Apply strict, need-to-know access controls to sensitive data
  • Build incident response plans that assume data exfiltration happened before detection

For more background on how LockBit rebuilt its operation after law enforcement disruption and what's changed in its latest version, read our full explainer on LockBit 5.0's evolution.