Lockbit5 CTI Report

**LockBit 5.0 (x64 hardened)**: reverse-engineered sample masquerading as "Corteva / Solstice Google Photos" that requests elevation; payload uses X25519 key-wrap + ChaCha20-20 + SHAKE256, performs chunked file encryption, RunPE process hollowing (defrag.exe/svchost), ETW tampering, VSS shadow-copy deletion via COM, SMB network propagation (ARP + async port-scan), and geo/UI-language fences; the report provides SHA-256/MD5, structural IOCs, three runtime-assembled onion addresses, and concrete detection/hunting guidance and mitigation recommendations.