Coordinating with the FBI and international partners, the National Crime Agency (NCA) took control of LockBit’s primary administrative environment—preventing the group from building and carrying out cyberattacks. This operation, dubbed Operation Cronos, has now prevented Lockbit from providing ransom-as-a-service. LockBit is a ransomware gang that has been operation for four (4) years; the group is responsible for attacks against thousands of victims across the world. According to the U.S. Department of Justice, LockBit has claimed over 2,000 victims and received over $120 million in ransom payment in their four years of operation.

In addition to disabling the service environment, NCA also obtained LockBit’s source code and intelligence about their ransomware deployments and technique. NCA has disabled LockBit’s unique data exfiltration tool (known as Stealbit) as well as twenty-eight (28) of the group’s servers. When analyzing these seized servers, NCA discovered data from companies that had paid ransoms—meaning that LockBit did not honor its agreements with companies to delete data that was taken. Finally, NCA obtained over 1,000 decryption keys from LockBit and plans to contact known ransom victims over the next few weeks to assist in data recovery.

Two Russian nationals have been indicted for conduct associated with LockBit as a part of Operation Cronos, which took a coalition of ten countries and multiple months to coordinate. Operation Cronos marks a significant step toward crippling LockBit and ensuring the group does not continue their criminal operation.