LockBit RaaS Operation Vitally Disrupted by Internationally Coordinated Law Enforcement Efforts

An international law enforcement operation proved successful once again in combating global cybercrime, this time disrupting the LockBit ransomware gang’s operations and successfully seizing their website. The joint operation was conducted by law enforcement agencies from ten (10) countries, including the UK’s National Crime Agency, the FBI, Europol, and several other international police agencies. “Operation Cronos,” as it’s being called, is an ongoing and developing operation against LockBit, one of the most prolific ransomware groups in the world. LockBit’s data leak site currently displays a banner that reads: “this site is now under the control of The National Crime Agency of the UK, Working in close cooperation with the FBI and the international law enforcement task force.” The LockBit ransomware-as-a-Service (RaaS) operation first appeared in late 2019 and has significantly outpaced activity of comparable groups since their emergence. Having been attributed to upwards of 2,300 attacks resulting in $120 million in ransom payments, the group sits at 1,400 more attacks than the next most active group, Conti. The group is estimated to have extorted at least $91 million from US organizations alone since the beginning of 2020 and has a prominent list of international victims including Boeing, the UK Royal Mail, the Continental automotive giant, and the Italian Internal Revenue Service. But beyond all else, their biggest reputation might come from their willingness to target organizations like hospitals and healthcare entities. Law enforcement has also claimed to have seized LockBit source code, chats, and victim information. Additionally, they seized 200 crypto-wallets, retrieved over 1,000 decryption keys to create a decryption tool and recover encrypted files, and arrested two (2) LockBit operators in Poland and Ukraine. Furthermore, as part of Operation Cronos, law enforcement was able to take down thirty-four (34) servers in the Netherlands, Germany, Finland, France, Switzerland, Austria, the US, and the UK, as well as obtain control of over 14,000 rogue accounts that were used by LockBit members to host tools and software used in attacks and to store data stolen from compromised entities. The US State Department is offering rewards via the Transitional Organized Crime Rewards Program – up to $10 million for information pertaining to LockBit leadership and an additional $5 million for that of anyone involved in LockBit ransomware attacks.