TLDR Tech / InfoSec
LockBit 5.0 Linux Malware Analysis: ChaCha20 + Curve25519 Offline Encryption, strace Evasion & IOCs
A reverse engineering teardown of LockBit 5.0's Linux variant found the ransomware encrypts entirely offline, generating ChaCha20 keys locally and wrapping them with a hardcoded Curve25519 public key so that zero network activity occurs during encryption, confirmed via Wireshark, socket monitoring, and interface counters. The sample also detects strace through TracerPid checks in /proc/self/status and fingerprints VM environments via /proc/ioports enumeration, forcing analysts to fall back on eBPF-based tracing to observe its behavior. The findings point to a broader shift toward offline-first ransomware design that makes network-based detection largely irrelevant against this class of threat.
Read the full story