Ransomware
LockBit successor group hits three European logistics firms in one week
A crew using rebuilt LockBit 4.0 tooling encrypted warehouse systems in Rotterdam, Hamburg and Gdansk after entering through unpatched VPN appliances.
/ 6 min read
Three logistics operators in the Netherlands, Germany and Poland confirmed ransomware incidents between 14 and 21 October. All three said warehouse management systems were taken offline for at least 36 hours.
Incident responders working on two of the cases told SentriXa the intrusions began on OpenGate SSL-VPN appliances still exposed to CVE-2026-001. The attackers moved laterally with stolen service accounts and deleted shadow copies before deploying the encryptor.
The group publishes victims on a leak site that reuses LockBit branding and negotiation templates. Researchers believe it is run by former affiliates rather than the original core team.
Defenders should patch the VPN flaw, rotate any service account that can reach file servers, and confirm that backups are immutable and stored outside the domain.
Filed under Malware & ThreatsRansomware
Tell us about your environment and a SentriXa security editor will get back to you within one business day.