Operation Cronos: LockBit Takedown
Police across ten countries seized LockBit's leak site and replaced it with their own. The defacement was funnier than anything the gang had ever posted.
For most of 2022 and 2023, LockBit was the most prolific ransomware brand on the internet. The crew claimed responsibility for incidents against Boeing, the UK Royal Mail, Ion Trading, and hundreds of smaller targets. It marketed itself with a professional affiliate portal, regular product releases, and internal QA on its encryption tooling.
A coordinated curtain pull
In February 2024, Operation Cronos — a joint effort led by the UK National Crime Agency with the FBI, Europol, and partners across ten countries — seized control of LockBit's leak site, its administrative panels, and roughly two hundred crypto wallets. Investigators recovered decryption keys for past victims and turned the leak site into a tongue-in-cheek law-enforcement splash page that counted down the unmasking of LockBit's leadership.
The performative element was deliberate. Ransomware brands trade in intimidation. By repurposing LockBit's own publication infrastructure to post mocking countdowns, the agencies were attacking the brand itself rather than just the infrastructure.
A short pause
LockBit reappeared within weeks on new infrastructure, sustained by its existing affiliate roster. But its credibility — the implicit guarantee to victims that paying meant deletion, and to affiliates that the brand was worth the cut — never fully recovered. Subsequent indictments named the group's purported administrator, a Russian national charged in absentia in the US, UK, and Australia.
What the chronicle remembers
Operation Cronos was a turning point in counter-ransomware policy. Earlier takedowns had focused on infrastructure; Cronos focused on reputation. The playbook of seizing a leak site and using it to mock the group has since been repeated against other brands.