Ransomware: lockbit5 named corisricambi.it (IT)

1. Executive summary

On 2026-09-25 the ransomware.live leak index recorded a victim entry for corisricambi.it, an Italian company, attributed to a group operating under the name "lockbit5". The listing carries no technical detail: no initial access vector, no malware family, no sample, no negotiation or exfiltration claim. The only supporting data point is a Hudson Rock panel showing one compromised user credential and one external attack surface entry for the victim domain, which is a lead, not a confirmed intrusion path. For EMEA financial services clients the direct exposure is limited to third-party and supply-chain relationships with the named victim; the material risk is that the "lockbit5" brand is being reused by an unrelated operator, and that any organisation relying on the LockBit name alone for triage will mis-scope its response. No CVE, no CVSS score and no CISA KEV entry apply to this item.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item.

The item is a leak-site listing with no confirmed incident facts, no affected service, and no evidence of impact on a financial entity or its ICT third-party chain. Mapping DORA Art. 17 or NIS2 Art. 23 to a single unverified victim post would be a compliance-checkbox exercise, not a regulatory obligation. The position changes the moment a client confirms that corisricambi.it is a live supplier, a data processor, or a shared-credential counterparty: at that point DORA Art. 28 (ICT third-party risk) and NIS2 Art. 21(2)(d) (supply chain security measures) become the operative references, and the client should treat the listing as a trigger for supplier due diligence rather than an incident report.

3. Technical analysis & attack chain

There is no confirmed attack chain in the source material. The primary item is a victim entry, not a technical report. What follows separates what is stated from what is inferred, and flags the inference.

Confirmed facts from the source:

1. ransomware.live published a victim entry on 2026-09-25T12:36:29Z naming corisricambi.it, country IT, website corisricambi.it.
2. The entry is attributed to a group labelled "lockbit5".
3. The victim description is a marketing paragraph in Italian describing CO.R.I.S. S.r.l. as operating for over twenty years. It contains no breach claim, no data sample, no deadline, and no ransom demand.
4. The Hudson Rock panel attached to the entry reports: Compromised Employees 0, Compromised Users 1, Third Party Employee Credentials 0, External Attack Surface 1.

Nothing in the source states how access was obtained, what malware was deployed, whether data was exfiltrated, or whether a ransom was paid. Any narrative beyond the four points above would be invention.

The "lockbit5" label requires care. The verified reference data contains no MITRE ATT&CK profile for an actor named "lockbit5", so the attribution is unconfirmed and should be treated as a self-assigned brand rather than a verified operator identity. The original LockBit operation was disrupted by law enforcement in 2024, and the ransomware-as-a-service ecosystem has a documented pattern of affiliates rebranding or reusing defunct brands to borrow notoriety and to pressure victims. A victim entry tagged "lockbit5" is therefore consistent with at least three scenarios: a genuine continuation of the LockBit codebase under new management, an unrelated affiliate using the name for leverage, or a low-effort listing with no real intrusion behind it. The source material does not distinguish between them.

The single compromised user credential reported by Hudson Rock is the only technical lead. It is a single-source observation from a third-party intelligence panel, not a confirmed initial access vector, and it should be verified before any enforcement action. If the credential is genuine and belongs to a corisricambi.it account, the plausible access paths are commodity: credential stuffing against an internet-facing service, infostealer malware on an employee endpoint, or password reuse from a prior third-party breach. None of these is stated in the source. The "External Attack Surface 1" figure is likewise an exposure count, not an exploited vulnerability.

Confidence caveats, stated plainly:

• The victim listing is single-sourced to ransomware.live. It has not been corroborated by the victim, by an Italian CERT, or by any second leak-site mirror in the material provided.
• The Hudson Rock credential and attack-surface figures are single-sourced and unverified. Treat them as a pivot, not as evidence.
• The "lockbit5" attribution is unconfirmed. No MITRE ATT&CK profile exists for this actor in the verified reference data.
• No malware sample, hash, C2 address, ransom note, or file path is present in the source. There is nothing to reverse-engineer.

4. Mitigation & containment

The actions below are scoped to what the source actually supports. They are supplier-risk and credential-hygiene actions, not incident response to a confirmed intrusion.

P1, within 24 hours:

• Determine whether corisricambi.it appears anywhere in your supplier register, procurement records, or accounts-payable vendor list. If it does, treat the relationship as potentially compromised until the supplier confirms otherwise, and route any pending payments through manual verification rather than automated release.
• Search identity logs for any authentication events involving corisricambi.it email domains or shared credentials. Where a match exists, force a password reset and revoke active sessions for the affected accounts.
• If your organisation has any credential overlap with the victim domain (shared SSO, delegated mailbox access, API keys issued to the supplier), rotate those secrets now. Do not wait for confirmation of the breach.

P2, within 72 hours:

• Contact the supplier directly through a channel you already trust, not through contact details in the leak listing, and ask for a written statement on whether an intrusion occurred, what data was affected, and what their containment status is. Record the response for your third-party risk file.
• Review the supplier's contractual security obligations against DORA Art. 30 (key contractual provisions with ICT third-party providers) if the supplier is an ICT third party under your DORA scope. If the contract has no breach-notification clause, that gap is now visible and should be remediated at renewal.
• Check whether the supplier holds or processes any of your data. If it does, and the supplier cannot confirm containment, escalate to your data protection function for a GDPR Art. 33 assessment.

P3, within 7 days:

• Add the victim domain to your third-party monitoring watchlist and re-check the leak site for updates, including any data sample publication, which would change the assessment materially.
• Review your supplier onboarding process for whether single-source leak-site listings trigger any action at all. Most organisations have no defined threshold, which means listings like this one are either ignored or over-escalated. A written threshold (for example: escalate when the supplier holds client data or has payment authority) removes the ambiguity.
• If you operate in the EU and the supplier falls within your NIS2 scope as a supply-chain dependency, document the review against NIS2 Art. 21(2)(d). The documentation is the deliverable; there is no technical control to deploy against an unconfirmed listing.

No vendor patch, version pin, or configuration change applies. There is no CVE in this item.

5. Indicators of compromise

The source material contains no atomic indicators: no hashes, no domains beyond the victim's own legitimate domain, no IP addresses, no file paths, no registry keys, no ransom-note strings. The victim domain corisricambi.it is the legitimate website of the named company and is not itself malicious; it is listed here only as a pivot for supplier matching.

Behavioural indicators:

domain  corisricambi[.]it

No further machine-pivotable indicators are available. Do not treat the actor label as an IOC; it is a self-assigned brand with no verified MITRE ATT&CK profile.

6. Detection

Insufficient indicators to author detection rules.

The source contains no distinctive strings, command-line flags, mutex names, scheduled-task names, file paths, registry keys, ransom-note text, or hard-coded values. The only artefacts present are the victim's own legitimate domain and an unverified actor label. A YARA or Sigma rule built from either would detect reporting about the incident, not the incident itself, and would generate false positives against the victim's normal business traffic. No rule is emitted.

If a sample, ransom note, or C2 address is published in a follow-up listing, detection content can be authored at that point.

7. Sources

• ransomware.live, "Ransomware: lockbit5 named corisricambi.it (IT)", https://www.ransomware.live/id/Y29yaXNyaWNhbWJpLml0QGxvY2tiaXQ1, published 2026-09-25.
• ransomware.live, "Victim: corisricambi.it – lockbit5" (Hudson Rock panel), https://www.ransomware.live/id/Y29yaXNyaWNhbWJpLml0QGxvY2tiaXQ1, accessed 2026-09-26.
• ransomware.live, "Ransomware: lockbit5 named httoy.fi (FI)", https://www.ransomware.live/id/aHR0b3kuZmlAbG9ja2JpdDU=, related corpus item, undated in the material provided.

All three sources are the same indexing platform. There is no independent corroboration of the victim listing, the credential count, or the actor attribution in the material provided.

8. Adverse Trace position

Adverse Trace assesses this item as low severity for EMEA financial services clients, on the basis that it is a single-source leak-site listing with no confirmed intrusion facts, no technical indicators, and an unconfirmed actor attribution. The "lockbit5" name carries no MITRE ATT&CK profile in our verified reference data, so we do not treat it as a verified operator identity and we do not attribute this listing to the historical LockBit group. The one compromised credential reported by Hudson Rock is a lead worth pivoting on if corisricambi.it is in your supplier chain, and nothing more. We will monitor the listing for a data sample or a second mirror, which would change the assessment, and we will re-issue if the victim confirms an intrusion or if a sample surfaces that supports detection content. Clients with a live supplier relationship to corisricambi.it should complete the P1 credential and payment checks in §4 and report back through their usual channel so we can correlate.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.