Threat Protection Coverage for LockBit 5.0

[Fariq_Zaidi]

Hi All,

We like to have clarification regarding the current threat protection capabilities of Palo Alto Networks firewalls against LockBit 5.0 ransomware, which has been reported as a newly emerging variant around September 2025.

Upon reviewing the ThreatVault database, we found several existing threat signatures related to LockBit (e.g., Trojan/Win32.lockbit.dp, LockBit Ransomware Powershell Script File Detection, DNS-based signatures, etc.). However, these signatures appear to have been released prior to September 2025, with the latest update we observed dated 21 January 2025. This indicates that they likely correspond to earlier variants of LockBit (e.g., v2.0 / v3.0 / v4.0).

We would like to seek clarification on the following:

1. Has Palo Alto released any specific signatures or advanced threat protection updates that cover LockBit 5.0?
2. If not yet available, can existing protection mechanisms such as behavior-based detection (WildFire), Advanced Threat Prevention, or IPS/AV coverage effectively block LockBit 5.0-related activities?
3. Is there an estimated timeline for when a signature or content update specific to LockBit 5.0 will be available in ThreatVault?
4. Are there recommended configuration best practices (e.g., security profile settings, file blocking policies, Zero Trust segmentation) to enhance protection against this new ransomware variant while awaiting an official signature?

thank you

[kiwi]

Hi @Fariq_Zaidi ,

Protection against known components of LockBit 5.0 is delivered via our regular content updates, which include specific Antivirus (AV) and Vulnerability Protection signatures.

You can verify the latest coverage by checking the ThreatVault database for these and related signatures (released September 2025):

• ThreatVault Query 1

• ThreatVault Query 2

• ThreatVault Query 3

• ThreatVault Query 4

• ThreatVault Query 5

Relying on signatures alone is insufficient for modern ransomware. LockBit 5.0 is designed for evasion (e.g., using a two-stage payload and API unhooking), which is why defense strategy should focused on behavioral and machine learning analysis:

• WildFire Real-Time ML and Sandboxing: This is your primary defense against zero-day and previously unknown ransomware samples. WildFire analyzes the payload in a virtual environment to detect malicious behaviors and instantly generates new protections, eliminating dwell time.

• Advanced Threat Prevention (ATP): This leverages inline machine learning models to detect malicious behaviors, exploit techniques (like process hollowing), and Command-and-Control (C2) patterns associated with ransomware activity, stopping the threat before it gets a signature.

• Anti-Spyware/Vulnerability Protection: These profiles stop common exploit techniques and lateral movement attempts (like abusing PowerShell) frequently leveraged by LockBit affiliates during the initial stages of an attack.

Ransomware mitigation is less about a single setting and more about a unified security posture. We strongly recommend following our best practice guidelines:

• Enable Decryption: You cannot stop threats you cannot see. Enable SSL/TLS decryption for high-risk and medium-risk traffic to inspect the encrypted payload delivery and C2 communications.

• Aggressive Security Profiles: Ensure all Security Profiles are set aggressively (e.g., Block actions) for:

  • File Blocking: Block the download/upload of high-risk executable files (PE files) and multi-level encoded files.

  • URL Filtering: Block all malicious URL categories (Malware, Phishing, Command-and-Control, Ransomware).

• Policy Best Practices: Apply the full set of Security Profiles (Anti-Spyware, Vulnerability Protection, Antivirus, WildFire Analysis, URL Filtering) to all relevant Allow rules to ensure comprehensive scanning of allowed applications.

For detailed steps on hardening your security profiles, please review the official documentation:

• Best Practice Internet Gateway Security Policy