LockBit 5.0 Returns After Crackdown — Ransomware Giant Turns to Cartel Model?
Introduction
LockBit, one of the most notorious ransomware groups in recent history, has announced its return with LockBit 5.0 — a reengineered version of its malware platform that promises faster encryption, stronger evasion, and a revamped affiliate program. After being nearly dismantled by law enforcement during Operation Cronos in 2024, many believed LockBit’s reign had ended. But the group has not only resurfaced — it is now positioning itself as part of a “ransomware cartel” alongside DragonForce and Qilin, a move that could redefine the future of cybercrime.
Also read: LockBit is Back in Business – 50+ Victims Reported in Just 60 Days
LockBit’s History: From ABCD to 5.0
LockBit’s journey highlights the rapid evolution of ransomware-as-a-service (RaaS).
- 2019 – ABCD Ransomware: Launched as a new entrant in the crowded ransomware market.
- LockBit 2.0 (2020-2021): Introduced StealBit, a tool designed for lightning-fast data theft and extortion.
- LockBit 3.0 (a.k.a. LockBit Black, 2022): Unveiled a bug bounty program, offering rewards to hackers who found vulnerabilities — the first of its kind in ransomware.
- LockBit 4.0 (2023): Announced but never fully deployed, with many speculating it was disrupted mid-development.
- LockBit 5.0 (2025): Modular, stealthier, and designed for resilience after the fallout of Operation Cronos.
Operation Cronos: A Major Setback
In early 2024, an international coalition of law enforcement agencies carried out Operation Cronos, striking at the core of LockBit’s operations.
- Infrastructure seized: Back-end servers, dashboards, and decryption keys.
- Affiliate details leaked: Names, cryptocurrency wallets, and contact logs were exposed.
- Public takedown banners: Law enforcement splash screens replaced LockBit’s portals.
At the time, security experts declared LockBit “finished.” But as history shows, ransomware groups rarely die — they evolve.
The Rebirth: LockBit 5.0
By mid-2025, LockBit 5.0 began appearing on darknet forums, packaged as a celebration of the group’s sixth anniversary.
Key Features of LockBit 5.0:
- Modular components for customized attack strategies.
- Faster encryption speeds for mass-scale attacks.
- Stealth upgrades to bypass modern endpoint security.
- New affiliate program with better profit-sharing to attract top-tier cybercriminals.
While its design suggests continuity with earlier versions, doubts remain:
- Is this the original LockBit gang rebuilding?
- Or a law enforcement honeypot trap?
- Or simply opportunists exploiting the brand name?
The Ransomware Cartel: DragonForce, Qilin, and LockBit
One of the most shocking developments is LockBit’s willingness to collaborate.
On the underground RAMP forum, DragonForce proposed forming a “ransomware cartel” — a pact that would end public rivalries, discourage affiliate poaching, and promote shared profits. LockBit and Qilin reportedly joined the initiative.
The key players:
- DragonForce – Bold, outspoken, and positioning itself as a cartel coordinator.
- Qilin – Rising fast with high-impact attacks.
- LockBit – Seeking a second reign as a global ransomware leader.
If successful, this cartel could stabilize the ransomware economy, making groups harder to disrupt.
Expert Reactions: What This Means for 2025
Cybersecurity analysts warn that the emergence of LockBit 5.0 and its cartel ambitions could mark a new chapter in ransomware evolution.
- Market consolidation: Instead of splintered groups competing, cartels may standardize operations and increase their resilience.
- Affiliate loyalty: Criminals may prefer cartel-backed groups that offer stability.
- Law enforcement challenge: Disrupting a unified cartel will be harder than targeting single groups.
One researcher notes:
“If this cartel holds, it could be the closest thing we’ve seen to organized cybercrime unions. Instead of infighting, they’re pooling resources. That’s bad news for defenders.”
Why This Matters?
The re-emergence of LockBit underscores the resilience of cybercriminal enterprises. Law enforcement can deliver devastating blows, but threat actors adapt. The shift from rivalry to cartel-building suggests a longer-term vision — one where ransomware becomes more industrialized, more stable, and more profitable.
Conclusion
LockBit’s return with version 5.0, combined with its cartel ambitions, signals that the ransomware world is entering a new era. Whether this alliance succeeds or collapses under the weight of competing egos remains to be seen. But one thing is certain: defenders must prepare for more sophisticated, coordinated, and resilient cyberattacks in 2025.
