LockBit 5.0: Linux Ransomware Encrypts Offline Without C2 Server

Imagine your central Linux server or virtualised server landscape being encrypted – and not a single one of your network-based security solutions raises the alarm. This is precisely the scenario that has become reality with the new ransomware variant LockBit 5.0 (LINUX Locker v1.01). The malware encrypts Linux systems entirely offline, meaning without any connection whatsoever to a command server operated by the attackers. This eliminates a detection mechanism that many small and medium-sized enterprises have, until now, quietly relied upon: the blocking of suspicious network traffic.

For you as the operator of a website or your own servers, this means the threat landscape has grown noticeably more dangerous. Even isolated Linux servers, or those only intermittently connected to the internet, are at risk once the malicious code has made its way onto the system. In this article, we explain in plain terms what has happened, how the new variant works technically, whether you could be affected and – above all – what concrete steps you need to take now.

What happened?

In September 2025 – conveniently timed to coincide with the group's sixth anniversary on the so-called RAMP forum, an underground platform for cybercriminals – the notorious ransomware group LockBit announced its version 5.0. Particularly explosive is the Linux variant with the internal designation LINUX Locker v1.01. It specifically targets Linux servers and virtualisation environments such as VMware ESXi and Proxmox – precisely the systems on which many companies run their entire IT infrastructure.

The crucial difference from older ransomware variants: LockBit 5.0 no longer requires an active command-and-control server (C2). A C2 server is normally the central command hub through which malware receives instructions or exchanges encryption keys. Because this data exchange takes place over the network, security solutions were previously often able to intervene at exactly that point and stop the attack. That option no longer exists.

LockBit is no unknown player. Back in February 2024, international law enforcement agencies dismantled large parts of the LockBit infrastructure as part of Operation Cronos. The return with version 5.0 shows that the group has by no means disappeared. In December 2025, a new data leak site went online, on which the first victims were published. In February 2026, detailed analyses by the security firms Acronis and Trend Micro confirmed the cross-platform capabilities for Windows, Linux and ESXi. And in April 2026, the malware analyst Netacoding demonstrated, through in-depth reverse engineering – that is, the disassembly and analysis of the malicious code – that the Linux variant does indeed operate entirely offline.

Technical background – explained in plain terms

LockBit 5.0 LINUX Locker v1.01 is a so-called ELF file for 64-bit systems (x86-64) – the standard program format under Linux. The malware requires no external dependencies and therefore runs independently.

The encryption

To encrypt the files, the malware combines two methods:

• ChaCha20 / XChaCha20: a fast encryption method for the actual file contents (symmetric encryption, in which the same key is used to encrypt and decrypt).
• Curve25519: a method for asymmetric key exchange, in which a public and a private key work together.

The crucial trick: the attackers' public key is hard-compiled into the program code. As a result, the malware needs no contact with a server to receive a key – it brings everything necessary with it. This is the core of its offline capability.

Speed and stealth

To inflict as much damage as quickly as possible, LockBit 5.0 relies on partial encryption: via a parameter (-r), it can be set to encrypt only 10 to 90 percent of a file. That is enough to render the file unusable while saving valuable time – the encryption is therefore dramatically faster. In addition, the malware uses multithreading, meaning it works in parallel across multiple processor cores.

Several anti-analysis techniques provide stealth:

• The malware actively blocks analysis and debugging tools such as strace, gdb or ltrace, which security researchers normally use to examine the program's execution.
• Once encryption is complete, the malware can, on request, overwrite free storage space with zeros to prevent later data recovery.
• By default, the malware then deletes itself to make forensic analysis – that is, the subsequent search for traces – considerably more difficult.

"The existence of mature Linux and ESXi variants, combined with the explicit support for virtualised environments such as Proxmox, underscores LockBit's continued expansion towards enterprise- and infrastructure-focused targets." – Acronis Threat Research Unit (TRU)

Who is affected?

In principle, all Linux distributions are at risk – the malware is not limited to a particular version. Special attention, however, falls on virtualisation environments: anyone running their servers via VMware ESXi or Proxmox is a preferred target. The reason is obvious: by encrypting the virtualisation host, an attacker can paralyse numerous virtual machines in one fell swoop – and with them, often the entire IT landscape of a company.

Important to understand: LockBit 5.0 is not a vulnerability in a product, but malware that first has to reach your system. So-called initial access – the first point of entry – typically occurs via:

• phishing emails
• brute-force attacks on remote access services such as RDP (Remote Desktop Protocol)
• the exploitation of vulnerabilities in internet-facing devices (edge vulnerabilities), for example in firewalls or VPN gateways – the source material cites, by way of example, the vulnerabilities CVE-2024-55591 and CVE-2023-4966.

For small and medium-sized enterprises, the situation is particularly serious. According to the security provider Guardz, 75 percent of SMEs are unable to resume operations following a ransomware attack – and only 14 percent are adequately prepared.

How to check whether you are affected

If you suspect you have fallen victim to LockBit 5.0, check for the following indicators:

1. Mass file renaming: Examine your file systems for files with a random, 16-digit hexadecimal file extension (example: .840d22e34b8e1f9e).
2. Ransom note: Look in the affected directories for the file ReadMeForDecrypt.txt. It contains the attackers' extortion message.
3. Unusual processes in the server logs: Pay particular attention to the execution of vim-cmd on ESXi hosts – this command is used to shut down running virtual machines before they are encrypted.
4. Suspicious data traffic: Check for unexplained spikes in outbound traffic. These can indicate data exfiltration – that is, the theft of your data before encryption.

What you need to do now

Since this is malware and not a single vulnerability, there is no patch you can simply install. Protection consists of prevention and the ability to detect an attack early. These four measures are decisive:

1. Introduce phishing-resistant multi-factor authentication (MFA): Secure all privileged access and VPN connections with a strong MFA solution, ideally based on the FIDO2 standard. MFA means that, in addition to the password, a second proof is required – for example a hardware key.
2. Consistent patch management: Keep all internet-facing systems – especially firewalls and VPN gateways – up to date. Critical vulnerabilities should ideally be closed within 24 hours of becoming known, because these are precisely a preferred point of entry.
3. Deploy behaviour-based Endpoint Detection and Response (EDR): Since network-based detection comes up empty against offline-operating ransomware, you need EDR solutions on your Linux and ESXi servers. These detect suspicious behaviour directly on the system – for instance the mass reading of system information or unusual processes.
4. Strictly isolate and protect backups: Separate your backup systems from the rest of the infrastructure through network segmentation. Your backups must be offline, immutable (that is, incapable of being manipulated after the fact) and regularly tested for recoverability. A backup that has not been tested is worthless in an emergency.

"For defenders, the conclusion is clear: behaviour-based detection at the endpoint level is the only reliable layer of protection against ransomware designed to operate entirely offline." – Netacoding, malware analyst

Perspective: How great is the danger really?

The risk posed by LockBit 5.0 must be rated as very high for SMEs in Germany. Offline encryption disables a central protective mechanism, and the deliberate focus on Linux as well as ESXi/Proxmox allows attackers to knock out central servers and poorly protected backups in a single strike.

The figures speak a clear language. According to Check Point Research, 2,122 ransomware victims were published on leak sites worldwide in the first quarter of 2026. LockBit climbed back to fourth place with 163 victims, recording a 106 percent increase in victim numbers compared to the previous quarter – more than a doubling.

The German Federal Office for Information Security (BSI) likewise names the danger clearly:

"The extortion of companies and public institutions through ransomware is the fastest-growing area of cybercrime. Among financially motivated actors, the operators and affiliates of LockBit are currently the greatest threat in Germany." – BSI

GDPR: The obligations you have in an emergency

A ransomware attack by LockBit 5.0 almost always constitutes a notifiable data breach under Article 33 GDPR. This applies even if data was "merely" encrypted and not stolen – because even the loss of the availability of personal data is a notifiable incident.

With LockBit, there is the aggravating factor that the group relies on double extortion: data is stolen before encryption, accompanied by the threat of its publication. This means there is a high risk to the individuals affected. Note the following deadlines and obligations:

• Notification to the competent supervisory authority must be made without undue delay and, where possible, within 72 hours of becoming aware.
• Where there is a high risk to the individuals affected, you must additionally inform them directly in accordance with Article 34 GDPR.
• Violations of these notification obligations can be penalised with fines of up to 10 million euros or 2 percent of worldwide annual turnover.

Conclusion

LockBit 5.0 marks a dangerous development in the ransomware landscape. Because of its fully self-contained offline encryption, classic network-based protective measures no longer take effect reliably. Anyone operating Linux servers or virtualisation environments such as ESXi and Proxmox should take the threat seriously – particularly as an SME, which is often less well protected and therefore a lucrative target.

The good news: you are not helpless in the face of this threat. Protection shifts from the network to the endpoint and to prevention. Concretely, this means: prevent initial access through strong MFA and rapid patching, detect an attack early through behaviour-based EDR solutions on your servers, and ensure that your backups are offline, immutable and tested. Because when everything is encrypted in an emergency, the quality of your backups decides whether your company can continue operating – or whether it belongs to the 75 percent that don't make it.