LockBit3 announces new blog domain for infrastructure

• Ransomware group: LockBit3
• Announcement date: December 5, 2025

LockBit3 announces new infrastructure via leak site

The ransomware group LockBit3 has published an announcement on its leak site regarding the launch of a new blog domain. This announcement, titled "new blog domain lockbit 5.0," serves as a formal introduction to a new piece of infrastructure intended to support the group's ongoing activities. The post was made public on December 5, 2025.

This development marks a strategic shift in the group's digital presence. Rather than announcing a specific breach or a victim, the group is focusing on the technical evolution of its communication channels. This type of announcement is significant as it signals the group's intent to maintain operational continuity despite previous disruptions to their network.

Claims regarding the new .onion domain

According to the post published by LockBit3, the group is introducing a new .onion domain. The group claims that this new infrastructure is specifically designed to be protected against FBI operations. By migrating or expanding their presence to this new domain, the group aims to ensure that their communications and operational updates remain accessible to their affiliates and targets.

The group has explicitly indicated that they intend to continue their operations through this new infrastructure. This move suggests a proactive approach to circumventing law enforcement efforts to dismantle their network. By establishing a new domain that they claim is resilient against federal investigations, LockBit3 is attempting to fortify its command and control capabilities and its ability to communicate with its ecosystem.

Data involvement and details

The listing does not name any specific data types or provide details regarding any stolen information. No data has been leaked as part of this specific announcement, as the post serves strictly as an announcement for the group's new infrastructure.

The LockBit group profile and history

LockBit is a known Ransomware-as-a-Service (RaaS) group that has been monitored by security researchers since 2019. The group has a history of significant impact on global cybersecurity landscapes. In February 2024, their infrastructure was disrupted by an international operation, which caused significant setbacks to their ability to conduct attacks.

Despite the major disruption caused by law enforcement in early 2024, reports indicated that the group resumed its operations following that event. The current announcement of a new blog domain appears to be a continuation of this resilience, as the group seeks to rebuild and evolve its digital footprint to avoid similar disruptions in the future.

Analysis and implications for organizations

This announcement can be interpreted as a concerted effort by the LockBit group to maintain operational continuity. The renewal and expansion of their infrastructure could potentially increase their future attack capacity and create significant resistance against law enforcement interventions. By evolving their technical setup, they aim to stay ahead of the efforts made by global authorities to take them down.

For organizations, this development introduces heightened risks. The evolution of ransomware infrastructure often leads to new phishing campaigns and increased ransomware risks as the threat actors refine their methods and communication channels. As these groups become more resilient, the complexity of their attacks may also increase.

To defend against these evolving threats, organizations should consider the following defensive measures:

• Monitor threat intelligence: Staying informed about the latest developments in ransomware infrastructure and group activities is crucial for proactive defense.
• Strengthen network security: Implementing robust security controls and monitoring network traffic can help detect and prevent unauthorized access.
• Enhance phishing awareness: Since infrastructure changes often coincide with new social engineering tactics, training employees to recognize phishing attempts is vital.

In conclusion, the move by LockBit3 to establish a new, supposedly protected .onion domain highlights the persistent nature of RaaS groups. Organizations are advised to remain vigilant and prioritize the hardening of their security postures to mitigate the risks posed by these evolving cybercriminal entities.