A Lockbit5-branded victim post tied to saico.co.th is best read as an extortion claim first, and a confirmed compromise only if internal evidence proves it.
A ransomware-branded claim tied to saico.co.th shows how quickly extortion theater can outrun confirmed evidence.