LockBit 5.0 Ransomware Activity

Navdeep Sharma@navvi24

•updated Dec 7, 2025•80•3•535

This query hunts for indicators of compromise (IOCs) and behaviors linked to the LockBit 5.0 ransomware variant. It identifies the creation of the ransom note, suspicious file renaming patterns using hexadecimal extensions, and network connections to known command-and-control (C2) infrastructure associated with LockBit activity.