Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

LockBit 5.0 – ESXi VM Power-Off Sequence Preceding VMDK Encryption

Lockbit5 Encryption / Impact Sentinel
MITRE ATT&CK
Data Encrypted for Impact
Data Source
Syslog
Date Added
2026-07-23
Last Updated
2026-07-23
Source
public LockBit 5.0 reporting (cross-platform ESXi payload); ransomware.live group profile (lockbit5)
What This Detects
LockBit 5.0 introduced cross-platform payloads explicitly targeting VMware ESXi; publicly reported ESXi ransomware behavior (consistent with LockBit's Linux/ESXi lineage) powers off running VMs via vim-cmd/esxcli immediately before encrypting their VMDK files.
Query
Syslog
| where TimeGenerated > ago(1d)
| where ProcessName in ("vim-cmd","esxcli") or SyslogMessage has_any ("vim-cmd vmsvc/power.off","esxcli vm process kill")
| summarize VmActions = count() by Computer, bin(TimeGenerated, 15m)
| where VmActions > 5

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.