# LockBit5 ransomware claims University of Technology Ho Chi Minh City

Published: 2026-06-20 · Severity: high · Sectors: education
Canonical: https://vorant.io/reports/7b51c857-b430-5243-a355-5792d7c05eff/lockbit5-ransomware-claims-university-of-technology-ho-chi-minh-city

> LockBit5 ransomware operators claim compromise of Vietnamese university with data exfiltration and credential theft.

LockBit5 ransomware operators have posted a claim of compromise against utb.edu.vn, the University of Technology Ho Chi Minh City in Vietnam. According to the posting indexed by Ransomware.live, the operators report access to 9 compromised employee accounts, 207 compromised user accounts, and 120 third-party employee credentials. The breach also exposed approximately 50 items of external attack surface and multiple DNS records associated with the victim's domain. The posting includes a leak screenshot purporting to demonstrate access to the victim's systems. This represents a typical data-extortion ransomware operation where operators encrypt systems and threaten to publish stolen data if ransom demands are not met.

## Mentioned in this report

- Threat actors: lockbit5
- Malware: LockBit5

Source reporting: https://www.ransomware.live/id/dXRiLmVkdS52bkBsb2NrYml0NQ==

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/7b51c857-b430-5243-a355-5792d7c05eff/lockbit5-ransomware-claims-university-of-technology-ho-chi-minh-city.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup