LockBit 5.0 Is Back in Europe’s Ransomware Top Five

LockBit 5.0 is active again and has returned to the top tier of European ransomware activity. Research released in August 2026 counted 1,115 ransomware attacks across Europe in the first half of the year, up 29 percent from the same period in 2025, and placed LockBit 5.0 back among the five most active groups.

That verified trend matters more than any single leak-site burst. Ransomware victim pages are attacker claims, not audited incident records, so weekly counts can move quickly and should be treated carefully. The harder fact is that a ransomware operation subjected to one of the most visible international law enforcement disruptions in recent years has managed to rebuild enough activity to matter again.

For infrastructure teams, that changes the planning assumption. A takedown can hurt a ransomware ecosystem without removing the underlying business model, affiliates, access brokers, malware knowledge, or financial incentives that made it successful.

How active is LockBit 5.0 in Europe in 2026?

TicTac Cyber Security's updated European ransomware research recorded 1,115 attacks in the first half of 2026, a 29 percent rise from the same period in 2025. Germany led the country count with 229 recorded attacks, followed by the United Kingdom with 202, France with 133, Italy with 126, and Spain with 98.

Within that wider market, LockBit 5.0 was back among the five most active groups after activity had dropped sharply following previous disruption. That position is more significant than a dramatic one-week number because it shows persistence across a longer measurement window.

A separate live feed published by Proven Data showed hundreds of public LockBit victim claims by August 17, 2026. Those numbers should not be confused with confirmed successful encryptions. Leak sites are part of extortion infrastructure, and a claim can represent stolen data, an intrusion with limited impact, a negotiation tactic, or a disputed event.

The signal worth carrying into risk planning is the direction. LockBit has enough current activity, tooling, and affiliate participation to remain relevant to European defenders.

Didn’t Operation Cronos kill LockBit in 2024?

Operation Cronos seriously damaged LockBit, but it did not permanently eliminate the operation. In February 2024, an international law enforcement effort led by the UK's National Crime Agency took control of LockBit services and infrastructure. Europol described the action as a major disruption of one of the world's most harmful ransomware operations.

The intervention exposed infrastructure, supported arrests and sanctions, and gave law enforcement access to decryption material that could help victims. The NCA said LockBit had been responsible for a quarter of ransomware attacks in the previous year, which helps explain why the operation received such an aggressive international response.

But ransomware as a service is designed to be distributed. Core developers maintain malware and infrastructure while affiliates gain access to victims and run intrusions. Initial access brokers, stolen credentials, phishing crews, and other criminal services can survive even when a brand's central servers are seized.

That makes disruption valuable but incomplete. It raises cost, destroys trust, burns infrastructure, exposes identities, and can scare affiliates away. What it cannot guarantee is that every skilled operator, customer, credential source, and codebase disappears at the same moment.

What changed with LockBit 5.0?

LockBit 5.0 represents another attempt to rebuild the ransomware platform around newer tooling and broader operating system coverage. Current technical analysis describes separate variants for Windows, Linux, and VMware ESXi, giving affiliates options across conventional endpoints and virtual infrastructure.

Cross-platform capability matters because modern data centers rarely have one clean operating system boundary. A Windows domain may authenticate users, Linux hosts may run applications, and ESXi may hold the virtual machines underneath both. Malware that can operate across those layers gives an attacker more ways to turn one identity compromise into broad operational disruption.

Technical reporting also describes defense evasion features intended to reduce visibility and interfere with security tooling. The details will keep changing, which is why defenders should avoid building a plan around one static malware signature. By the time a ransomware payload starts encrypting, the most valuable defensive opportunities may already have passed.

The better strategy is to detect the steps that come first: suspicious remote access, new privileged accounts, credential dumping, lateral movement, unusual archive creation, backup tampering, mass file access, and unexpected connections between management systems.

Why does cross-platform ransomware matter to virtualization teams?

Virtualization concentrates risk. A single hypervisor or management plane can host dozens or hundreds of workloads, so an attacker who reaches that layer can create a much larger blast radius than an attacker who compromises one ordinary server.

That does not mean every LockBit 5.0 intrusion automatically reaches the hypervisor. It means the recovery design should assume the attacker may try. Virtualization credentials, backup credentials, storage administration, and directory privileges should not collapse into one shared administrative identity.

This is especially important during migrations and platform consolidation. Teams moving away from VMware, expanding Proxmox, or mixing multiple hypervisors often create temporary accounts and broad network rules to make the transition easier. Temporary access has a habit of becoming permanent, and ransomware operators benefit from exactly that kind of forgotten trust.

Mr.PlanB's Proxmox backup comparison is useful here because backup architecture should be chosen with the hypervisor failure domain in mind. A backup server that shares the same credentials and administrative path as production may be easier to operate, but it is also easier to lose in the same compromise.

What should backup teams assume about a LockBit intrusion?

Assume the attacker will look for recovery infrastructure before the encryption phase. Modern ransomware operations make more money when the victim has fewer clean options, so backup consoles, hypervisor managers, storage arrays, domain administrators, and replication systems are natural targets.

That means recovery controls should be intentionally inconvenient for an attacker. Separate credentials, isolated management paths, immutable or offline copies, protected retention, multi-factor authentication, and restricted deletion rights all reduce the chance that one stolen administrative session can erase the entire recovery plan.

The DeadLock recovery analysis reaches the same practical point from a different ransomware family: backups matter when they remain independent from the failure that destroys production. The product name matters less than the separation.

Testing is equally important. Restore one representative workload into an isolated network. Measure how long it takes. Verify application consistency, not only VM boot. Confirm that DNS, certificates, secrets, and databases can be rebuilt without reaching back into a compromised production environment.

What does the European ransomware growth say about defense priorities?

The first-half 2026 numbers suggest organizations should plan for ransomware as a recurring operational risk rather than an exceptional event. Manufacturing remained one of the most targeted sectors in the European study, with business services close behind. Those are environments where downtime quickly becomes expensive and where attackers can pressure victims through both encryption and stolen data.

The concentration in major European economies also matters for suppliers. A company does not need to be a famous enterprise to sit inside the blast radius. Smaller engineering firms, logistics providers, MSPs, software vendors, and professional services companies can hold privileged access or sensitive information belonging to much larger customers.

This is why security reviews should include third-party remote access and service accounts. A backup platform can be perfectly hardened while a supplier's credential still provides the path into production. Recovery planning has to consider the identity and network relationships that connect organizations, not only the local server inventory.

What would I change after seeing LockBit return?

I would not redesign an environment around LockBit 5.0 specifically. I would use its return as proof that ransomware brands and affiliate ecosystems can recover after major disruption, then make controls resilient to that reality.

The first priority would be administrative separation. Hypervisors, backups, identity systems, and storage should not all trust the same account path. The second would be tested recovery from a copy an attacker cannot casually delete. The third would be visibility into the pre-encryption behavior that ransomware affiliates depend on, especially credential abuse and lateral movement.

If those controls already exist, keep testing them. If they do not, the comeback of LockBit is a useful deadline. Law enforcement can disrupt criminal infrastructure, security vendors can detect payloads, and patches can close individual vulnerabilities. Your recovery architecture still has to work on the day the attacker gets past all three.