LockBit5 claims Major Cineplex ransomware attack

20 June 2026 high threat retailmedia

Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.

LockBit5 ransomware gang claims to have compromised Major Cineplex, affecting thousands of employee and user accounts.

LockBit5, a prominent ransomware-as-a-service operation, has publicly claimed responsibility for a ransomware attack against Major Cineplex, a major cinema chain. According to ransomware.live, the incident compromised 79 employee accounts, 9,858 user credentials, and 42 third-party employee credentials. The attack also exposed 119 external attack surface entries and associated DNS records. This represents a significant breach of customer and employee data. The attack was likely preceded by infostealer malware infections that harvested credentials, which were then used to facilitate the ransomware deployment. The public posting of this claim indicates the attacker is using a leak site to pressure the victim into ransom negotiation.

Mentioned in this report

Threat actors lockbit5

Malware LockBit5

Detection guidance

Shadow Copy and Recovery Inhibition Commands Typical of Ransomware Pre-Encryption

ATT&CK T1486

Detects shadow copy deletion and boot recovery tampering commonly run by ransomware affiliates (such as LockBit) just before encrypting data. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Shadow Copy and Recovery Inhibition Commands Typical of Ransomware Pre-Encryption
description: Detects commands that delete volume shadow copies, wipe backup catalogs
  or disable Windows recovery, which ransomware operators run before encryption for
  impact. The report gives no command lines, so this rule covers generic pre-encryption
  behaviour rather than one sample.
tags:
- attack.impact
- attack.t1486
- attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    Image|endswith: \vssadmin.exe
    CommandLine|contains|all:
    - delete
    - shadows
  selection_wmic:
    Image|endswith: \wmic.exe
    CommandLine|contains|all:
    - shadowcopy
    - delete
  selection_wbadmin:
    Image|endswith: \wbadmin.exe
    CommandLine|contains:
    - delete catalog
    - delete backup
    - delete systemstatebackup
  selection_bcdedit:
    Image|endswith: \bcdedit.exe
    CommandLine|contains|all:
    - recoveryenabled
    - 'no'
  condition: 1 of selection_*
falsepositives:
- Backup or storage administrators deliberately pruning shadow copies with vssadmin
  or wbadmin
- Disk imaging or system deployment scripts that disable recovery with bcdedit
level: high
id: 0038d991-e1c4-57ab-896f-b7299a93c377
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/bWFqb3JjaW5lcGxleC5jb21AbG9ja2JpdDU=

Outbound SMB Connection to Public IP Address

ATT&CK T1187

Detects SMB (TCP 445) connections from Windows hosts to non-private addresses, which can indicate forced authentication that leaks NTLM credentials. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Outbound SMB Connection to Public IP Address
description: Detects outbound TCP 445 connections from Windows hosts to non-RFC1918
  addresses. This is a common sign of forced authentication, where a lure such as
  a UNC path or a crafted file makes the host send NTLM credentials to an external
  server. The report only lists forced authentication as a mapped technique, so this
  is a generic detection.
tags:
- attack.credential-access
- attack.t1187
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: 'true'
    DestinationPort: 445
  filter_private:
    DestinationIp|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
    - 127.0.0.0/8
    - 169.254.0.0/16
    - ::1/128
    - fe80::/10
    - fc00::/7
  condition: selection and not filter_private
falsepositives:
- Legitimate SMB access to cloud file services such as Azure Files over port 445
- Hosts using site-to-site or split-tunnel VPN with file servers on publicly routed
  address space
level: medium
id: f93c044d-11e2-5dfc-a5e4-6c95d3ad34f4
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/bWFqb3JjaW5lcGxleC5jb21AbG9ja2JpdDU=

2 more detections for this report are in the app — the rules that match its indicators, plus the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. Three days of it free, no card.

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ransomware.live/id/bWFqb3JjaW5lcGxleC5jb21AbG9ja2JpdDU=

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.

It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.

Create a free account What it costs