← threat actors
threat actor · not yet in the cluster map
lockbit
also tracked as qilin 2, the gentlemen 1
5 stories · 0 in the wild · June 22, 2026 – August 23, 2026
evidence: 4 claimed · 1 demonstrated
sectors
- finance 2 · Aug 23
- manufacturing 2 · Jul 19
- technology 1 · Aug 22
- telecom 1 · Aug 22
- education 1 · Jul 19
- energy 1 · Jul 19
- government 1 · Jul 19
- retail 1 · Jun 22
geography
- united states 2 · Aug 23
- argentina 1 · Jul 19
- colombia 1 · Jul 19
- india 1 · Jul 19
- singapore 1 · Jul 19
- uk 1 · Jul 19
- usa 1 · Jul 19
- dominican republic 1 · Jun 22
- italy 1 · Jun 22
- taiwan 1 · Jun 22
- thailand 1 · Jun 22
- vietnam 1 · Jun 22
malware and tools
- lockbit 5.0 2 · Aug 10
- qilin 2 · Jul 19
- lockbit 1 · Jul 19
- the gentlemen 1 · Jul 19
what we reported, newest first, grouped by story
August 23, 2026
- LockBit is openly recruiting initial-access brokers, offering either outright purchase of access or a share of the ransom with the group handling negotiation (@FalconFeedsio). The group also listed U.S. Bank with a 3 September publication deadline; the bank says it has so far found no evidence of compromise (@DailyDarkWeb). Scepticism is warranted — @Zenul_Abidin argues the brand is "a shell of its former self" now padding its leak site.
· Aug 23 · claimed · Threat Activity
August 22, 2026
- LockBit5 is reportedly recruiting initial-access brokers and affiliates, offering a cut of ransom payments or direct purchase of access to companies, banks and platforms — attribution to the LockBit brand is unconfirmed (@DarkWebInformer).
· Aug 22 · claimed · Threat Activity
August 10, 2026
- LockBit 5.0's Linux build uses ChaCha20 + Curve25519 offline encryption and strace-based evasion, per a technical analysis with IOCs (netacoding).
· Aug 10 · demonstrated · Threat Activity
Jun 17 – July 19, 2026
- Ransomware roundup: Qilin claimed eight new victims including a Bay Area private school and a Mississippi catfish processor (DarkWebInformer); The Gentlemen listed Colombian oil-and-gas firm Ecopetrol and the U.S. Navy's Military Sealift Command (FalconFeeds); LockBit 5.0 added six victims across India, Singapore, Argentina and the UK (FalconFeeds).
· Jul 19 · claimed · as qilin, the gentlemen · Threat Activity
June 22, 2026
- Qilin named a Taiwanese machinery maker, a Bangkok hotel, and a US lighting distributor; LockBit 5.0 posted four new victims across Italy, the Dominican Republic, the US, and Vietnam. Qilin, LockBit.
· Jun 22 · claimed · as qilin · Ransomware & Hacktivism