Operation Cronos dismantles LockBit ransomware gang

Law enforcement agencies Tuesday announced the disruption and dismantling of LockBit, which Europol called the "world's biggest ransomware operation."

A coalition of international law enforcement agencies, led by the U.K.'s National Crime Agency (NCA), took down LockBit's infrastructure as part of "Operation Cronos," a monthslong effort to halt the ransomware-as-a-service gang's activity and bring its members to justice. Security researchers first spotted the seized domains Monday.

"Today, after infiltrating the group's network, the NCA has taken control of LockBit's services, compromising their entire criminal enterprise," the agency said in its announcement.

In addition to the disruption campaign, coordinated actions with Europol included the arrests of two suspected LockBit members in Poland and Ukraine Tuesday morning, as well as the seizure of more than 200 cryptocurrency accounts linked to the gang.

Operation Cronos involved law enforcement agencies from the U.S., France, Germany, the Netherlands, Sweden, Australia, Canada, Japan and Switzerland. The disruption campaign seized 28 servers in three countries, according to the NCA, and brought down LockBit's public leak site, the group's administration portal and other sites as well.

In addition to taking down the ransomware gang's infrastructure, the NCA said it obtained LockBit's source code, more than 1,000 decryption keys and "a vast amount of intelligence" on the gang from its compromised systems.

The infiltration of LockBit's network also provided evidence of what many cybersecurity experts and threat analysts have long believed -- that ransomware gangs retain victims' stolen data even after they pay ransoms. "Some of the data on LockBit's systems belonged to victims who had paid a ransom to the threat actors, evidencing that even when a ransom is paid, it does not guarantee that data will be deleted, despite what the criminals have promised," the NCA said.

Europol also announced that law enforcement agencies have identified more than 14,000 "rogue accounts" that LockBit actors used for infrastructure and data exfiltration, which have been referred for removal. The NCA also obtained the ransomware gang's custom data exfiltration tool, known as StealBit.

"As of today, LockBit are locked out. We have damaged the capability and most notably, the credibility of a group that depended on secrecy and anonymity," NCA Director General Graeme Biggar said in the announcement. "Our work does not stop here. LockBit may seek to rebuild their criminal enterprise. However, we know who they are, and how they operate. We are tenacious and we will not stop in our efforts to target this group and anyone associated with them."

U.S. Attorney General Merrick Garland said LockBit was one of the most prolific ransomware gangs in the world, responsible for more than 2,000 victims and $120 million in extortion payments. Garland urged all victims of LockBit and ransomware attacks in general to contact the FBI.

"Actions like today's would not be possible without victims reporting their ransomware attacks to law enforcement," he said in a video statement. "LockBit is not the first ransomware variant the Justice Department and its international partners have dismantled. It will not be the last."