On February 19, 2024, the LockBit ransomware group's infrastructure went offline. In its place, UK National Crime Agency and FBI joint messaging appeared on the darknet sites that had hosted LockBit's victim portal, affiliate panel, and data leak site. "This site is now under the control of the National Crime Agency of the UK, working in close cooperation with the FBI and the international law enforcement task force, 'Operation Cronos.'" The seizure notice listed 11 participating agencies from 10 countries.

LockBit had been the most prolific ransomware group in the world for the preceding two years. By victim count, it had attacked more organizations than any other group: approximately 2,000 confirmed victims, with over $120 million received in ransoms. Its victims included the UK's Royal Mail, the Industrial and Commercial Bank of China (ICBC), Boeing, a major Japanese maritime shipping operator (Nippon Kodo), and hundreds of hospitals, schools, municipal governments, and private businesses. The Operation Cronos takedown was the most significant ransomware disruption operation in history - and LockBit was back online within days.

The LockBit Operation

LockBit was a Ransomware-as-a-Service operation with a brand reputation for reliability and technical quality. The group maintained a detailed "affiliate program" - ransomware operators paid to use LockBit's encryption software, C2 infrastructure, and leak site. The split was approximately 80/20 in the affiliates' favor, with LockBit taking 20% of ransom payments. The group actively recruited affiliates with competitive terms and responsive technical support.

LockBit 3.0 (also called LockBit Black), released in 2022, incorporated code from the leaked BlackMatter/DarkSide source code and added a bug bounty program where researchers could be paid for finding vulnerabilities in the LockBit builder or C2 infrastructure. The group published a detailed manifesto explaining their business model and philosophy. They ran a "data leak countdown" on their site where the clock pressure was used to coerce victims into paying. They innovated the "StealBit" data exfiltration tool for fast, efficient data theft. LockBit positioned itself as a professional service with reliable performance for affiliates.

The LockBit builder was leaked in September 2022 by a disgruntled developer, resulting in dozens of spin-off LockBit-based ransomware operations by other groups. Despite this, LockBit continued to dominate the ransomware landscape by affiliate count and victim volume through 2023 and into 2024.

[TECHNICAL NOTE]
LockBit 3.0 technical architecture: the locker used a combination of AES (symmetric) and RSA (asymmetric) encryption. Files were encrypted with AES; the AES key was encrypted with an RSA public key embedded in the binary. The RSA private key was held by LockBit's infrastructure, enabling decryption only after ransom payment. LockBit 3.0 used a "configuration" build system where affiliates could customize behavior (extensions to encrypt/exclude, ransom note contents, self-propagation behavior, deletion of shadow copies, stopping specific services). The binary used process injection and NTFS transaction rollback to hide file writes. Self-propagation was via PSExec/WMI using harvested credentials or via GPO deployment in domain-joined environments. LockBit 3.0 incorporated an anti-analysis feature: it required a password flag on the command line at execution, preventing automated sandbox analysis. The StealBit data exfiltration tool was a separate binary with fast multi-threaded upload capabilities designed to exfiltrate before encryption began. LockBit's affiliate panel provided analytics on victim negotiations, payment status, and file hosting for stolen data publication.

Operation Cronos

Operation Cronos was a multinational law enforcement effort coordinated by Europol and Eurojust, involving the UK NCA, FBI, DOJ, and agencies from Australia, Canada, France, Germany, Japan, Netherlands, Sweden, and Switzerland. The operation combined technical infiltration of LockBit's infrastructure with simultaneous law enforcement actions across multiple jurisdictions.

Law enforcement seized 34 LockBit servers, obtained over 1,000 decryption keys (provided to victims through Europol's no-ransom portal), froze 200+ cryptocurrency accounts, and arrested two LockBit operators in Poland and Ukraine. The NCA/FBI published an extensive dossier on "LockBitSupp" - the group's administrator - including his real name, Dmitry Khoroshev, a Russian national, and indicted him in the US and UK. Khoroshev remains in Russia and is subject to OFAC sanctions.

The most psychologically impactful element of the Operation Cronos response was what law enforcement did with the seized infrastructure. Rather than simply taking it down, they operated LockBit's data leak site for several days, publishing their own content in LockBit's style - including a "countdown" timer revealing Khoroshev's identity. They published details of LockBit's operational security failures, internal communications, and information about affiliates. They used LockBit's own infrastructure against it, demonstrating that law enforcement had been inside the system for months.

[WARNING]
The Operation Cronos takedown demonstrated both the capabilities and limits of international law enforcement against ransomware. The capabilities: coordinated seizure of infrastructure across multiple countries, identification and indictment of top operators, provision of decryption keys to victims, and effective psychological operations against the group's brand. The limits: LockBit resumed operations within five days on new infrastructure. Khoroshev remains in Russia beyond extradition reach. Affiliates (the actual operators conducting attacks) largely scattered to other RaaS platforms. The decentralized RaaS model means that taking down the core infrastructure doesn't eliminate the human operators or their capabilities - affiliates migrate to competing platforms (ALPHV, Play, Akira, and others absorbed former LockBit affiliates). Law enforcement described the operation as a sustained campaign rather than a single event, with subsequent arrests and actions continuing through 2024. The broader lesson: disruption operations are valuable for imposing costs and obtaining intelligence (the decryption keys and affiliate data obtained during Operation Cronos had lasting value), but the "ransomware problem" cannot be solved by law enforcement alone without addressing the safe harbor that Russia and other non-cooperative jurisdictions provide to ransomware operators.

The Aftermath

LockBit's post-takedown behavior was revealing. Within days of the seizure, a new LockBit darknet site appeared. Khoroshev attempted to rehabilitate the brand, claiming the FBI had only seized servers running PHP (the website) and had not compromised the actual encryption infrastructure. He offered bounties for information on law enforcement tactics and posted defiant messages. The attempt was partially successful in terms of resuming operations, but LockBit never recovered its pre-Cronos volume or affiliate count.

Multiple senior LockBit affiliates were subsequently identified and arrested through information obtained during Operation Cronos. The data law enforcement obtained from the seized infrastructure - affiliate communications, victim lists, transaction records - continued to yield intelligence and arrests months after the initial takedown. The British Columbia university breached by LockBit, ICBC, Boeing, and the UK Royal Mail all saw their cases proceed through Cronos-obtained information.

[IOC]
LockBit 3.0 indicators: encrypted files received a random extension (configurable by affiliate); ransom note "Restore-My-Files.txt" in each encrypted directory; desktop wallpaper changed to LockBit branding. StealBit exfiltration tool (used before encryption): uploaded files to LockBit C2 at high speed with multi-threaded transfer. LockBit binary required a command-line password for execution (anti-sandbox); if run without the password, it exits without encrypting. Specific hashes and YARA rules published in Operation Cronos advisory. CISA/FBI/MS-ISAC advisory AA23-075A (March 2023) provides the most comprehensive LockBit indicators and TTPs. Post-Cronos, LockBit 3.0 builder remained publicly available from the September 2022 leak; any LockBit-based ransomware attack may use the builder without affiliation with the original group. Dmitry Khoroshev ("LockBitSupp"): DOB 1993, Russian national, Voronezh, Russia. OFAC SDN listing: 2024. DOJ indictment: District of New Jersey. $10 million reward offered by US State Department for information leading to his arrest.