The Health Information Sharing and Analysis Center, a nonprofit organization that works to share threat intelligence, issued an alert Oct. 1 regarding LockBit 5.0, a ransomware variant that represents an elevated risk to healthcare and other enterprises.
The variant is the latest iteration of the ransomware-as-a-service group, which resurfaced in September after a law enforcement disruption earlier in 2025. The group has expanded its cross-platform capabilities to target Windows, Linux and VMware ESXi environments, according to the alert.
LockBit 5.0 has enhanced obfuscation and evasion techniques, improved flexibility for affiliates, and the ability to encrypt entire virtual infrastructures. The ransomware appends randomized 16-character file extensions and clears event logs while terminating 63 security services to hinder detection and recovery.
Health-ISAC said analysis confirms the variant builds on LockBit 4.0’s codebase and demonstrates the group’s technical evolution. The organization advised members to reassess their defenses, strengthen protections for ESXi hosts and implement layered security measures to mitigate risk.
Becker’s 3rd Annual Fall Chief Pharmacy Officer Summit is the top tier event that the people leading the future of pharmacy convene. This 3-day event is built specifically for Chief Pharmacy Officers and senior pharmacy leaders. The sessions examine the workforce, financial and clinical priorities shaping pharmacy today. Becker’s is where candid discussions flourish and new ideas thrive. Becker's 3rd Annual Fall Chief Pharmacy Officer Summit
