A global law enforcement campaign called Operation Cronos has led to the arrest of four people who are allegedly involved in LockBit ransomware attacks and the shutdown of nine servers tied to the LockBit ransomware network. These actions are included in the third phase of Operation Cronos led by the United Kingdom’s National Crime Agency (NCA). In February 2024, the operation successfully shut down the LockBit ransomware group’s online infrastructure. Despite LockBit’s claim that its operations were quickly restored, it demonstrated the significant disruption caused by Operation Cronos, which lasted longer than the group claimed. The NCA also acquired approximately 7,000 decryption keys, enabling victims to retrieve encrypted data.
The investigation identified the leader of LockBit as Dmitry Khoroshev, also known as “LockBitSupp,” a Russian national. He is sanctioned by the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC), the UK’s Foreign, Commonwealth & Development Office (FCDO), and Australia’s Department of Foreign Affairs. Khoroshev, together with alleged LockBit members Ivan Kondratyev and Artur Sungatov, was indicted for their participation in the attacks. In July 2024, two group members pled guilty to their roles in LockBit operations.
Authorities acquired substantial intelligence during the operation, revealing that, contrary to LockBit’s claims, stolen data is not always deleted after ransoms are paid. By February 2024, the group had reportedly extorted as much as $1 billion from over 7,000 ransomware attacks carried out from June 2022 to February 2024.
The latest Operation Cronos phase saw the coordinated action of 12 countries’ law enforcement agencies, with the support of Europol and Eurojust. Authorities arrested four more people connected to the LockBit operation, which include an alleged developer who was detained while on holiday outside of Russia, following a request from French law enforcement under an extradition treaty. Two arrests were made in the UK: one person is suspected as a LockBit affiliate, and another for laundering money for the group. These individuals were identified through data analysis conducted after the seizure of LockBit’s infrastructure in February.
UK Foreign Secretary David Lammy emphasized the importance of targeting Russia’s cybercriminal ecosystem, stating that Putin’s corrupt mafia state must be combatted. Operation Cronos sent a clear message that Russian cyber-attacks, whether from the state or its criminal networks, are not tolerated.
In Spain, the administrator of a bulletproof hosting service utilized by LockBit got arrested at Madrid airport. Spanish authorities seized nine servers connected to the group. The U.S., UK, and Australia enforced sanctions on 31-year-old Russian national Aleksandr Ryzhenkov, a known affiliate of LockBit, for his role in ransomware attacks and money laundering. Ryzhenkov is also linked to Evil Corp, a well-known cybercrime group.
Evil Corp is believed to be behind stealing an estimated $300 million over the last 10 years. While Evil Corp has long been associated with ransomware attacks, particularly through the use of BitPaymer ransomware, this is the first instance linking the group to LockBit operations. LockBit denied any collaboration with Evil Corp.
Ryzhenkov is believed to be a key figure in the LockBit group, responsible for developing over 60 versions of the ransomware and orchestrating numerous attacks, demanding ransoms exceeding $100 million. He has been indicted in the U.S. for his involvement in Evil Corp’s operations, including BitPaymer ransomware attacks on victims throughout Texas and other parts of the United States.
Deputy Attorney General Lisa Monaco stated the importance of addressing the ransomware threat with the support of law enforcement partners worldwide. Victims must be prioritized and criminals held accountable. Healthcare organizations complying with HIPAA training requirements must address these issues as well.
