Loading story…
An international law-enforcement operation led by the UK National Crime Agency disrupted LockBit’s ransomware-as-a-service operation on February 20, 2024. Working with the FBI and partners from nine other countries, investigators infiltrated LockBit’s network, took control of its primary administration environment and dark-web leak site, and seized source code and intelligence on affiliates. Operation Cronos also dismantled Stealbit data-exfiltration infrastructure across three countries, took down 28 affiliate servers, froze more than 200 cryptocurrency accounts, and led to arrests in Poland and Ukraine alongside U.S. charges and indictments. Authorities obtained more than 1,000 decryption keys to support victim recovery.
LockBit relaunched its leak site on February 24 and listed 16 victims by February 26, signaling that the disruption had not eliminated the operation. The group claimed investigators exploited vulnerabilities in its PHP servers while backup infrastructure remained unaffected, and announced plans to harden infrastructure, distribute affiliate access across multiple servers, and manually release decryptors. A free recovery tool became available through No More Ransom, although its coverage across attack dates and LockBit variants remained unclear. Victims should seek assistance through law enforcement and assess available decryption tools; the NCA found that LockBit retained victim data even after ransom payments. The disruption could undermine affiliate confidence, but LockBit’s recovery and affiliate migration to other ransomware operations remain risks.
TTPs, infrastructure, and targeting history in one profile.
11 events from the most recent confirmed update back to the earliest known activity.
In its public disclosure of the operation, the NCA revealed that seized LockBit systems still contained data belonging to victims who had paid ransoms. The finding showed that payment did not guarantee deletion of stolen information.
The US Department of Justice announced that two defendants accused of using LockBit were charged and in custody. Authorities also unsealed indictments against two additional Russian nationals accused of conspiring to conduct LockBit attacks.
Authorities arrested two LockBit actors in Poland and Ukraine as part of the coordinated operation. They also froze more than 200 cryptocurrency accounts linked to the group.
International authorities disrupted LockBit, taking control of its primary administration environment and dark-web leak site and seizing source code, operational intelligence, and more than 1,000 decryption keys. ReliaQuest reported 34 servers taken down and more than 14,000 rogue accounts seized; the NCA separately identified 28 affiliate servers taken down and Stealbit infrastructure seized across three countries.
LockBit 3.0, also known as LockBit Black, began operating. The report noted that this version likely used different encryptors from earlier LockBit versions.
Operation Cronos began as an international investigation targeting LockBit. The UK National Crime Agency led the operation, with Europol and Eurojust coordinating European action.
LockBit announced plans to strengthen infrastructure security and distribute affiliate-panel access across multiple servers according to partners' trust levels. It also announced plans to release decryptors manually and offer trial file decryptions.
LockBit administrators claimed law enforcement exploited vulnerabilities in the group's PHP servers while leaving backup infrastructure unaffected. The group acknowledged what it described as its own negligence and claimed its attack against Fulton County motivated the operation.
By 10 a.m. ET on February 26, LockBit's reestablished data-leak website listed 16 victims.
LockBit reestablished a data-leak website after the law-enforcement disruption, demonstrating that the group had resumed part of its public-facing operations.
Following Operation Cronos, a free LockBit decryption tool became available through the No More Ransom portal. Its coverage of specific attack dates and ransomware versions remained unclear.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
An international law enforcement operation led by the UK's National Crime Agency and the FBI seized LockBit infrastructure on 19 February 2024, disrupting one of the world's most prolific ransomware-as-a-service groups. Follow-on actions publicly identified and sanctioned a senior LockBit leader, while officials said the campaign targeted the gang's administrators, infrastructure, and criminal affiliates. Subsequent reporting said the disruption sharply reduced LockBit's standing in ransomware rankings after years in which the group had claimed thousands of victims across more than 100 countries. Threat research shows LockBit's reach was driven by a scalable affiliate model rather than malware alone, with intrusions commonly starting through abused VPN, Citrix, and RDP access or stolen credentials, followed by use of tools such as **Impacket**, **Mimikatz**, **PsExec**, **Rclone**, and **StealBit**. Affiliates increasingly targeted **VMware ESXi** environments to maximize operational impact, and some skipped encryption entirely in favor of data-theft extortion using LockBit-branded notes. The group's earlier attacks included a reported **$80 million** demand against CDW, but researchers and investigators warn that even as LockBit declines, its affiliates and copycats are likely to continue operating under other ransomware brands.
Aug 14, 2026
International law enforcement agencies said **Operation Cronos** disrupted LockBit, the ransomware-as-a-service group long described as the world’s most prolific ransomware operation. Authorities seized infrastructure, took control of LockBit’s leak site and platform, exposed affiliates, delivered decryption keys to victims, and publicly revealed that the group sometimes retained stolen victim data and failed to provide working decryptors. According to the FBI, LockBit operated from 2020 to 2024, hit more than **2,500 organizations** in at least **120 countries**, and collected more than **$500 million** in ransom payments; several members have since been arrested or charged, while alleged leader **Dmitry Yuryevich Khoroshev** remains indicted, sanctioned, and at large.
Jul 28, 2026
LockBit 5.0, a major ransomware-as-a-service operation, recently attempted to reestablish its presence by launching a new 'secure' blog domain with claims of enhanced protection against law enforcement. However, security researchers quickly identified and publicly exposed the IP address and domain (`karma0[.]xyz`, IP: `205.185.116.233`), revealing multiple open ports and vulnerable remote access, which left the infrastructure susceptible to disruption. Further analysis showed that LockBit was recycling old victim data on its leak site, with several entries originating from previous leaks or other ransomware groups, highlighting operational security failures and attempts to maintain the appearance of ongoing activity. This exposure comes in the wake of a significant international law enforcement operation (Operation Cronos) that disrupted LockBit's infrastructure, compromised its administration panel, and led to the public release of affiliate and victim data. Despite these setbacks and reputational damage, LockBit has demonstrated resilience, attempting to reassert itself by reusing old data and launching new infrastructure, though these efforts have been undermined by continued security lapses. Defenders are advised to block the exposed IP and domain and monitor for further developments as the group persists in its operations.
Jun 29, 2026