Anatomy of a Breach

Anatomy of a Breach: Operation Cronos — International Law Enforcement Dismantles LockBit

> series: anatomy_of_a_breach —— part: 182 —— event: operation_cronos —— target: lockbit —— led_by: uk_nca —— decryption_keys: 1,000+<span class="cursor-blink">_</span>_

Hedgehog Security 28 February 2024 14 min read

The UK's NCA leads the takedown of the world's most prolific ransomware group.

On 19 February 2024, the UK's National Crime Agency (NCA), working with the FBI, Europol, and law enforcement agencies from 10 countries, executed Operation Cronos — a coordinated takedown of LockBit's ransomware infrastructure. The operation seized 34 servers across multiple countries, obtained over 1,000 decryption keys (which were made available to victims), froze cryptocurrency accounts, arrested affiliates in Poland and Ukraine, and indicted Russian nationals identified as key figures.

In a striking act of counter-messaging, law enforcement repurposed LockBit's own dark web leak site to publish details of the operation, mock the group's leader (identified as Russian national Dmitry Khoroshev), and release information about the group's operations, affiliates, and financial transactions. LockBit had been the world's most active ransomware operation — responsible for attacks against Royal Mail, ICBC, Boeing, and over 2,000 other victims worldwide, extracting more than $120 million in total ransom payments. While LockBit would attempt to rebuild, Operation Cronos significantly disrupted its operations and demonstrated that ransomware groups are not beyond the reach of law enforcement.


Recommended

Not sure where to start?

We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.

Free Scoping Call

The NCA at the forefront of the global fight against ransomware.

Most Significant Ransomware Takedown
Operation Cronos was the most impactful law enforcement action against ransomware in history — disrupting the group that had attacked <a href="/blog/anatomy-of-a-breach-royal-mail-lockbit">Royal Mail</a> and <a href="/blog/anatomy-of-a-breach-icbc-lockbit">ICBC</a>. The NCA's leadership role demonstrated the UK's commitment to combating ransomware at the highest level. <a href="https://www.cyber-defence.io/services/incident-response">UK Cyber Defence</a> works alongside law enforcement during ransomware investigations.
1,000+ Decryption Keys Released
Over 1,000 decryption keys were obtained and made available to victims — enabling recovery without paying ransom. This demonstrated the value of law enforcement engagement during ransomware incidents: seized infrastructure can yield decryption keys. <a href="https://www.cyber-defence.io/services/incident-response">UK Cyber Defence's incident response</a> includes law enforcement liaison and decryption key coordination.
Counter-Messaging on LockBit's Own Site
Using LockBit's dark web site to publish takedown details was a psychological operation designed to undermine trust among ransomware affiliates — demonstrating that law enforcement could compromise their infrastructure and identify their operations. <a href="https://www.socinabox.co.uk/blog/what-is-the-dark-web-business-guide">Dark web monitoring</a> through <a href="https://www.socinabox.co.uk">SOC in a Box</a> tracks ransomware group activity and takedown operations.
Disruption, Not Elimination
Operation Cronos significantly disrupted LockBit but did not eliminate ransomware. The group attempted to rebuild, and other groups (ALPHV/BlackCat, Cl0p, and others) continued operating. Ransomware defence remains essential: <a href="/cyber-essentials">Cyber Essentials</a>, <a href="/penetration-testing">penetration testing</a>, <a href="https://www.socinabox.co.uk">SOC in a Box</a>, and <a href="https://www.cyber-defence.io/services/incident-response">incident response capability</a>.

Law enforcement is catching up. But prevention remains your responsibility.

Operation Cronos demonstrated that ransomware groups can be disrupted by determined, coordinated law enforcement action. But the operation also revealed the scale of the problem: 2,000+ victims and $120+ million in payments from a single group. Ransomware defence cannot depend on law enforcement alone — organisations must implement preventive controls. Cyber Essentials provides the baseline. Penetration testing validates defences. SOC in a Box detects ransomware deployment. And UK Cyber Defence provides the incident response capability that engages law enforcement effectively when ransomware strikes.


LockBit was disrupted but ransomware continues. Are your defences ready for the next group?

<a href="/cyber-essentials">Cyber Essentials</a> provides the baseline. <a href="/penetration-testing">Penetration testing</a> validates defences. <a href="https://www.socinabox.co.uk">SOC in a Box</a> detects ransomware. <a href="https://www.cyber-defence.io/services/incident-response">UK Cyber Defence</a> engages law enforcement.

Next Step

Not sure where to start?

We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.

Free Scoping Call

Related Articles