How Operation Cronos took down LockBit, the world's most prolific ransomware gang

In February 2024, anyone opening LockBit's dark-web leak site was met with an unfamiliar sight: the badges of the UK's National Crime Agency (NCA), the FBI and police agencies from many countries. The page had been taken over. According to a detailed account of the operation published on dev.to, that seizure was only the visible part of a much deeper intrusion into the world's most productive ransomware operation.

A criminal franchise at scale

LockBit surfaced around 2019 and grew into the most prolific ransomware outfit on record. The US Justice Department, as cited in the dev.to write-up, put its toll at more than 2,000 victims and over $120 million in collected ransoms.

The gang ran on a ransomware-as-a-service model: a core team developed the encryptor, the negotiation panel and the leak site, while independent affiliates carried out the intrusions and deployed the payload, keeping the larger share of each payment. The operation maintained support staff, shipped software updates and even ran a bug bounty for its own malware. Its boss, using the handle LockBitSupp, was confident enough in his anonymity to publicly offer $10 million to anyone who could unmask him — a wager he would come to regret.

Operation Cronos

On 19 and 20 February 2024, an NCA-led effort involving the FBI, Europol and partners in roughly ten countries struck at the gang's core. As dev.to recounts, investigators gained control of LockBit's administration platform and its leak site, confiscated servers along with cryptocurrency accounts, secured around a thousand decryption keys that allowed victims to restore files rather than pay, and collected intelligence on the affiliates responsible for the intrusions.

The police then did something unusual. Instead of posting a bare seizure notice, they rebuilt the leak site in LockBit's own visual style, complete with countdown clocks ticking toward disclosures about the gang, and taunted LockBitSupp ahead of an identity reveal. The write-up frames this as deliberate psychological pressure: ransomware relies on trust between operators and affiliates, and suddenly every affiliate had to wonder what the NCA knew about them.

The deletion promise that wasn't

One finding stands out for any organisation weighing a ransom payment. Investigators discovered that LockBit retained stolen data from victims who had already paid. The guarantee that payment means deletion turned out to be false. The practical conclusion is blunt: a ransom buys a criminal's word, and that word cannot be enforced.

Unmasking the leader

In May 2024, the UK, US and Australia identified LockBitSupp as Dmitry Khoroshev, a Russian national. He was sanctioned, charged in the US, added to the FBI's Cyber Most Wanted list, and the US offered up to $10 million for information leading to his arrest. He had offered the same sum to keep his identity secret; investigators revealed it at no charge.

Did the takedown finish the job

Not entirely. LockBit attempted a comeback with fresh infrastructure and defiant messaging, but its standing never fully recovered. Affiliates drifted toward rival groups, and the brand that once dominated the ransomware landscape lost its pull. The dev.to piece argues this is the realistic measure of success in cybercrime policing: not necessarily a final arrest, but the dismantling of a business model.

What defenders can take from it

The write-up closes with practical lessons. Affiliates typically get in through stolen VPN credentials, unpatched edge devices and exposed remote desktop services, so closing those gaps takes an organisation off the easy-target list. Restorable backups turn a ransom note into a recoverable incident rather than a crisis negotiated under pressure. Reporting to authorities matters, because takedowns of this kind rely on victim reporting, and reporting is often what gets decryption keys back to affected organisations. Finally, any data known to be stolen should be treated as already public, whatever a gang promises after payment.

Why it matters

Operation Cronos shows that even the largest ransomware operation amounts to little more than servers, a website and trust among criminals that does not survive contact with investigators. It also punctures the central argument for paying ransoms, since data from victims who paid was kept regardless. For technical teams, the actionable takeaways are unglamorous but proven: patch edge infrastructure, protect remote access, maintain tested backups, and report incidents so that the next operation of this kind can happen.