CRITICALRansomware
Verified
Global

LockBit 5.0 Deploys AI-Powered Ransomware with Automated Network Mapping

·Source: FBI Flash Alert

Updated:

Executive Summary

LockBit 5.0 features AI module for automated reconnaissance, high-value target identification, and optimized encryption timing.

Analysis

LockBit 5.0 includes "LockBrain" — an AI module that automates network recon, identifies critical systems and backups, and determines optimal encryption timing based on victim activity patterns. Generates customized ransom notes from victim financial data. Average demands exceed $5M.

Timeline

Discovered
Mar 22, 2026
Exploitation Detected
Mar 22, 2026
Published
Mar 29, 2026
Source Attribution

Originally published by FBI Flash Alert on Mar 29, 2026. Verified by: FBI, CISA.

Related Threats

HIGHRansomware

Microsoft Takes Down Malware-Signing Service Behind Ransomware Attacks

Microsoft on Tuesday said it disrupted a malware-signing-as-a-service (MSaaS) operation that weaponized the company's Artifact Signing system to deliver malicious code and conduct ransomware and other attacks, compromising thousands of machines and networks across the world. The tech giant attributed the activity to a threat actor it calls Fox Tempest, which it said offered the MSaaS scheme

The Hacker News
HIGHRansomware

FBI warns students and staff that ShinyHunters may come knocking after Canvas breach

Having receive a ransom payment for its attack on Canvas, ShinyHunters and other extortion gangs are only likely to be further incentivised to launch similar attacks in future. Read more in my article on the Hot for Security blog.

Graham Cluley
CRITICALRansomware

Microsoft disrupts malware code-signing service used by ransomware gangs

Microsoft has disrupted the infrastructure powering the largest malware code-signing service used to help ransomware groups and other cybercriminals make malicious programs harder to detect on Windows. The threat actors behind the service used stolen identities and impersonated legitimate organizations to obtain more than 1,000 code-signing certificates. Microsoft seized the group’s website, signs

CSO Online