> series: anatomy_of_a_breach —— part: 182 —— event: operation_cronos —— target: lockbit —— led_by: uk_nca —— decryption_keys: 1,000+<span class="cursor-blink">_</span>_
On 19 February 2024, the UK's National Crime Agency (NCA), working with the FBI, Europol, and law enforcement agencies from 10 countries, executed Operation Cronos — a coordinated takedown of LockBit's ransomware infrastructure. The operation seized 34 servers across multiple countries, obtained over 1,000 decryption keys (which were made available to victims), froze cryptocurrency accounts, arrested affiliates in Poland and Ukraine, and indicted Russian nationals identified as key figures.
In a striking act of counter-messaging, law enforcement repurposed LockBit's own dark web leak site to publish details of the operation, mock the group's leader (identified as Russian national Dmitry Khoroshev), and release information about the group's operations, affiliates, and financial transactions. LockBit had been the world's most active ransomware operation — responsible for attacks against Royal Mail, ICBC, Boeing, and over 2,000 other victims worldwide, extracting more than $120 million in total ransom payments. While LockBit would attempt to rebuild, Operation Cronos significantly disrupted its operations and demonstrated that ransomware groups are not beyond the reach of law enforcement.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping CallOperation Cronos demonstrated that ransomware groups can be disrupted by determined, coordinated law enforcement action. But the operation also revealed the scale of the problem: 2,000+ victims and $120+ million in payments from a single group. Ransomware defence cannot depend on law enforcement alone — organisations must implement preventive controls. Cyber Essentials provides the baseline. Penetration testing validates defences. SOC in a Box detects ransomware deployment. And UK Cyber Defence provides the incident response capability that engages law enforcement effectively when ransomware strikes.
<a href="/cyber-essentials">Cyber Essentials</a> provides the baseline. <a href="/penetration-testing">Penetration testing</a> validates defences. <a href="https://www.socinabox.co.uk">SOC in a Box</a> detects ransomware. <a href="https://www.cyber-defence.io/services/incident-response">UK Cyber Defence</a> engages law enforcement.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping Call