LockBit 5.0 Linux Ransomware Encrypts Offline with ChaCha20 and Curve25519, Evades strace
A new analysis shows LockBit 5.0’s Linux variant generates ChaCha20 keys locally, wraps them with a hard‑coded Curve25519 public key, and encrypts files entirely offline. It also bypasses traditional strace monitoring using eBPF tracing and wipes free space aggressively, raising the bar for ransomware evasion on Linux servers.