Threat Protection Coverage for LockBit 5.0

[Fariq_Zaidi]

Hi All,

We like to have clarification regarding the current threat protection capabilities of Palo Alto Networks firewalls against LockBit 5.0 ransomware, which has been reported as a newly emerging variant around September 2025.

Upon reviewing the ThreatVault database, we found several existing threat signatures related to LockBit (e.g., Trojan/Win32.lockbit.dp, LockBit Ransomware Powershell Script File Detection, DNS-based signatures, etc.). However, these signatures appear to have been released prior to September 2025, with the latest update we observed dated 21 January 2025. This indicates that they likely correspond to earlier variants of LockBit (e.g., v2.0 / v3.0 / v4.0).

We would like to seek clarification on the following:

1. Has Palo Alto released any specific signatures or advanced threat protection updates that cover LockBit 5.0?
2. If not yet available, can existing protection mechanisms such as behavior-based detection (WildFire), Advanced Threat Prevention, or IPS/AV coverage effectively block LockBit 5.0-related activities?
3. Is there an estimated timeline for when a signature or content update specific to LockBit 5.0 will be available in ThreatVault?
4. Are there recommended configuration best practices (e.g., security profile settings, file blocking policies, Zero Trust segmentation) to enhance protection against this new ransomware variant while awaiting an official signature?

thank you