An FBI agent explains that breaking affiliate trust and leveraging global partnerships were pivotal in Operation Cronos, which effectively crippled the world’s largest ransomware‑as‑a‑service group. The coordinated takedown seized LockBit’s infrastructure and shattered its credibility.

Key Takeaways

  • Operation Cronos seized LockBit’s servers and source code
  • Breaking affiliate trust destroyed the group’s credibility
  • Multi‑nation collaboration accelerated the takedown

The Rise and Fall of LockBit

Between 2020 and 2024, LockBit victimised over 2,500 organisations across 120 countries, with more than 1,800 attacks in the United States alone. The gang amassed over $500 million in ransom payments, funneling 20 cents of every dollar to Russian leader Dmitry Khoroshev.

According to Brett Leatherman, assistant director of the FBI’s Cyber Division, the RaaS model relied on a network of roughly 200 affiliates who handled platform access, malware deployment, negotiations and payouts.

Read Also:CISA Urges Immediate Patching of Exploited Microsoft, VMware, and Apple Vulnerabilities

Why This Matters

BozokMedia analysis shows that trust is the lifeblood of ransomware‑as‑a‑service; once that trust is broken, the entire criminal enterprise collapses. By exposing affiliates on the group’s own leak site, law‑enforcement turned their anonymity into a liability.

"Ransomware sells anonymity and payday; destroy the anonymity and the payday disappears," Leatherman explained.

Core Tactics of Operation Cronos

The operation commandeered LockBit’s leak site, control panel, source code and servers, and distributed decryption keys to victims. This not only halted the financial flow but also inflicted irreversible damage to the group’s reputation.

The U.S. Department of Justice has placed a $10 million bounty on Khoroshev, while several senior members have been arrested or charged.

Did You Know?: In just three months of 2023, LockBit collected over $200 million in ransom payments.

Frequently Asked Questions

Q1: Is LockBit still a threat?

A: Its operational impact has been severely reduced, though a few affiliates remain intermittently active.

Q2: Which international agencies participated in Operation Cronos?

A: The UK’s National Crime Agency, Europol and ten other national cyber units collaborated with the FBI.