# LockBit5 claims Major Cineplex ransomware attack

Published: 2026-06-20 · Severity: high · Sectors: retail, media
Canonical: https://vorant.io/reports/b68a5976-f7c6-5336-a46b-426cdfa781fb/lockbit5-claims-major-cineplex-ransomware-attack

> LockBit5 ransomware gang claims to have compromised Major Cineplex, affecting thousands of employee and user accounts.

LockBit5, a prominent ransomware-as-a-service operation, has publicly claimed responsibility for a ransomware attack against Major Cineplex, a major cinema chain. According to ransomware.live, the incident compromised 79 employee accounts, 9,858 user credentials, and 42 third-party employee credentials. The attack also exposed 119 external attack surface entries and associated DNS records. This represents a significant breach of customer and employee data. The attack was likely preceded by infostealer malware infections that harvested credentials, which were then used to facilitate the ransomware deployment. The public posting of this claim indicates the attacker is using a leak site to pressure the victim into ransom negotiation.

## Mentioned in this report

- Threat actors: lockbit5
- Malware: LockBit5

## Detection guidance (public sample)

### Shadow Copy and Recovery Inhibition Commands Typical of Ransomware Pre-Encryption

ATT&CK: T1486

Detects shadow copy deletion and boot recovery tampering commonly run by ransomware affiliates (such as LockBit) just before encrypting data. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Shadow Copy and Recovery Inhibition Commands Typical of Ransomware Pre-Encryption
description: Detects commands that delete volume shadow copies, wipe backup catalogs
  or disable Windows recovery, which ransomware operators run before encryption for
  impact. The report gives no command lines, so this rule covers generic pre-encryption
  behaviour rather than one sample.
tags:
- attack.impact
- attack.t1486
- attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    Image|endswith: \vssadmin.exe
    CommandLine|contains|all:
    - delete
    - shadows
  selection_wmic:
    Image|endswith: \wmic.exe
    CommandLine|contains|all:
    - shadowcopy
    - delete
  selection_wbadmin:
    Image|endswith: \wbadmin.exe
    CommandLine|contains:
    - delete catalog
    - delete backup
    - delete systemstatebackup
  selection_bcdedit:
    Image|endswith: \bcdedit.exe
    CommandLine|contains|all:
    - recoveryenabled
    - 'no'
  condition: 1 of selection_*
falsepositives:
- Backup or storage administrators deliberately pruning shadow copies with vssadmin
  or wbadmin
- Disk imaging or system deployment scripts that disable recovery with bcdedit
level: high
id: 0038d991-e1c4-57ab-896f-b7299a93c377
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/bWFqb3JjaW5lcGxleC5jb21AbG9ja2JpdDU=
```

### Outbound SMB Connection to Public IP Address

ATT&CK: T1187

Detects SMB (TCP 445) connections from Windows hosts to non-private addresses, which can indicate forced authentication that leaks NTLM credentials. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Outbound SMB Connection to Public IP Address
description: Detects outbound TCP 445 connections from Windows hosts to non-RFC1918
  addresses. This is a common sign of forced authentication, where a lure such as
  a UNC path or a crafted file makes the host send NTLM credentials to an external
  server. The report only lists forced authentication as a mapped technique, so this
  is a generic detection.
tags:
- attack.credential-access
- attack.t1187
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: 'true'
    DestinationPort: 445
  filter_private:
    DestinationIp|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
    - 127.0.0.0/8
    - 169.254.0.0/16
    - ::1/128
    - fe80::/10
    - fc00::/7
  condition: selection and not filter_private
falsepositives:
- Legitimate SMB access to cloud file services such as Azure Files over port 445
- Hosts using site-to-site or split-tunnel VPN with file servers on publicly routed
  address space
level: medium
id: f93c044d-11e2-5dfc-a5e4-6c95d3ad34f4
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/bWFqb3JjaW5lcGxleC5jb21AbG9ja2JpdDU=
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

2 more detections for this report are in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://www.ransomware.live/id/bWFqb3JjaW5lcGxleC5jb21AbG9ja2JpdDU=

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/b68a5976-f7c6-5336-a46b-426cdfa781fb/lockbit5-claims-major-cineplex-ransomware-attack.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup