Provisional profile auto-created from leak-site claims — not analyst-vetted. A group's self-claim of a victim, not a confirmed breach.
The four features of this adversary's intrusions under the Diamond Model — adversary, capability, infrastructure, victim — assembled from tracked data; pivot from any vertex to the others.
Attribution ≠ confirmation. lockbit5 is linked here via TTP overlap and shared infrastructure — not confirmed by original-source reporting. Treat this as a working hypothesis, not a settled fact.
See the analysis →