Modularity advances LockBit 5.0 ransomware

Highly prolific LockBit ransomware-as-a-service gang has bolstered its operations with the new LockBit 5.0 variant, which features increased modularity despite being mostly based on the LockBit 4.0 codebase, according to Cyber Security News.

Improved sophistication exhibited by LockBit 5.0 is apparent in its two-stage execution model, which begins with the use of a covert loader for persistence, a report from Flashpoint revealed. After leveraging control flow obfuscation for dynamic execution path calculation, the loader proceeds to use a hashing algorithm to dynamically resolve API calls before reloading core library copies to evade security tools.

Attackers then used the loader to craft a suspended defrag.exe instance, which triggered the second stage involving decrypted payload delivery. Installation of the payload via process hollowing was followed by an instruction pointer update and subsequent in-memory execution, said researchers, who noted that the entire process remained undetected by security systems.