iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
LockBit-branded activity has returned: Check Point Research counted 163 victims posted to monitored leak sites in the first quarter of 2026, and an October 3 advisory from Nigeria’s NCC-CSIRT reported LockBit 5.0 in active attacks. But those reports do not establish that a particular newly surfaced leak site is run by the same operators or uses the same infrastructure as LockBit’s pre-2024 site.
Is LockBit back?
There is evidence of renewed LockBit-branded activity, though the evidence comes in different forms. Check Point Research’s report, published May 11, 2026, counted 163 LockBit victim postings on monitored data-leak sites during January–March and ranked the group fourth for the quarter. The report describes the activity as a LockBit 5.0 comeback.
Separately, an advisory dated October 3, 2026, from NCC-CSIRT, the Nigeria Communications Commission’s incident-response team, says Acronis Threat Research Unit identified LockBit 5.0 in active attacks. The advisory title names Windows, Linux, and ESXi platforms; that alone does not establish technical details about how the malware behaves on each platform.
These are meaningful signs of a resurgence, but they do not independently verify the identity of the people behind any specific new leak site. The named reports do not establish that its operators, infrastructure, or victim claims are continuous with the LockBit site disrupted in 2024.
#1 Best Overall
- World’s First 6TB 2.5” Portable Hard Drive
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
What the evidence does—and does not—show
| Evidence | What it establishes | What it does not establish |
|---|---|---|
| 163 LockBit victim postings on monitored leak sites in Q1 2026, according to Check Point Research’s May 11 report | LockBit-branded listings appeared during that quarter; Check Point ranked LockBit fourth among groups it tracked. | That 163 separate attacks were independently confirmed, that all attacks occurred during the quarter, or that the listed victims are exhaustive. |
| LockBit 5.0 activity reported in the NCC-CSIRT advisory dated October 3, 2026 | Acronis researchers identified LockBit 5.0 in active attacks, as summarized by the advisory. | The identity of a particular leak-site operator, technical details beyond the advisory’s stated scope, or the number and locations of victims. |
| A newly surfaced site described as LockBit’s | The reported site is part of the story being discussed. | Its launch date, control by the original operators, infrastructure continuity, or the validity of its victim claims. |
A leak-site entry is an extortion claim, not independent confirmation of an incident. CISA, the FBI, MS-ISAC, and international partners warn in their June 2023 LockBit advisory that “The leak sites only show the portion of LockBit affiliates’ victims subjected to secondary extortion.” A listing also cannot reliably establish when an attack happened: victims may be omitted, and a post may appear after the underlying incident.
What LockBit 5.0 and a leak site mean
LockBit is described by CISA and partner agencies as a ransomware-as-a-service operation. In this model, developers maintain ransomware capabilities and affiliates use them to conduct attacks, typically under a fee or revenue-sharing arrangement. The LockBit name on a claim therefore does not, by itself, identify which people carried out an intrusion.
Rank #2
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
LockBit affiliates have used double extortion: stealing data and encrypting systems, then threatening to publish the stolen information if the victim does not meet their demands. A leak site can serve as part of that pressure campaign by naming alleged victims or publishing data. Because it reflects only some victims subjected to this secondary extortion, it is not a complete incident tracker or a reliable measure of the group’s total activity.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →How the resurgence fits with the 2024 disruption
In February 2024, the U.S. Department of Justice and U.K. National Crime Agency announced an international disruption of LockBit. DOJ reported at the time that the operation had targeted more than 2,000 victims and that victims had paid more than $120 million in ransom. It also described ransom demands totaling hundreds of millions of dollars. Those are historical figures attributed to DOJ’s 2024 announcement, not current totals.
Rank #3
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
The disruption is important context, but renewed LockBit-branded postings and the later report of LockBit 5.0 activity show why a law-enforcement takedown should not be treated as proof that a threat name or capability has disappeared permanently. The available evidence supports renewed activity; it does not settle whether the particular newly surfaced site is controlled by the same operators.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What organizations should do
Organizations should treat a LockBit-branded listing as a reason to assess exposure, not as a complete or automatically verified account of an incident. CISA’s interagency LockBit advisory is the relevant starting point for mitigation guidance. Practical resilience also depends on tested backups and a recovery plan: backups that have not been restored in practice may not be dependable when systems are disrupted.
Quick Recap
Best Value
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Rank #4
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
- Use CISA’s LockBit advisory to review mitigation measures for your organization’s environment.
- Keep backups protected from the systems they are meant to recover, and test restoration as part of recovery planning.
- If your organization is named on a leak site, preserve relevant evidence and involve your incident-response, legal, and security teams; a public claim alone does not determine what data was accessed or when.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
