LockBit Resumes Operations Days After Law-Enforcement Takedown, Report Says
Summary
A multinational operation seized LockBit infrastructure and led to arrests and indictments, but the group claimed it resumed operations after four days. DarkOwl says the takedown’s lasting impact remains uncertain.
Key points
- On February 19, 2024, law enforcement took control of LockBit’s leak site as part of Operation Cronos, led by the UK National Crime Agency.
- Authorities said the operation compromised LockBit’s platform and other infrastructure, seized 34 servers, and resulted in two arrests, three international arrest warrants, and five indictments.
- Law enforcement said it had obtained some decryptor keys and urged victims to contact them for possible assistance.
- Authorities reported identifying 30,000 bitcoin addresses associated with LockBit, including 500 active addresses that had received more than $125 million.
- A message attributed to LockBit said the group still had access to victim data and would continue operating; DarkOwl could not authenticate an earlier circulating letter from the group.
- By February 22, an onion mirror appeared to be partially operational. DarkOwl assessed that the disruption lasted about four days and that the operation’s longer-term impact was uncertain.
Article Details
- Event Type
- Law enforcement disruption and seizure of LockBit ransomware infrastructure
- Impact
- A multinational law enforcement operation led by the UK National Crime Agency compromised LockBit’s primary platform and other infrastructure and took down 34 servers. Two alleged LockBit affiliates were arrested, and arrest warrants and indictments were issued. Law enforcement said it had obtained some decryptor keys and identified cryptocurrency addresses associated with the group. LockBit later claimed that its infrastructure was disabled for only four days, that some mirrors remained operational, and that it retained victim data and would continue operating; the article notes uncertainty about the disruption’s lasting effect.
Threat Actors
Malware
LockBitLast week one of the most prolific and successful groups, LockBit, became a target themselves with law enforcement (LE) action taking down their leak site and confirmation of sanctions against some of their affiliates.LockBit 2.0The groups have had several iterations, LockBit 2.0 first emerged in 2021, and targeted many high value victims throughout that year and into 2022.
Countries
AustraliaThis includes the takedown of 34 servers in the Netherlands, Germany, Finland, France, Switzerland, Australia, the United States, and the United Kingdom.FinlandThis includes the takedown of 34 servers in the Netherlands, Germany, Finland, France, Switzerland, Australia, the United States, and the United Kingdom.FranceThis includes the takedown of 34 servers in the Netherlands, Germany, Finland, France, Switzerland, Australia, the United States, and the United Kingdom.GermanyThis includes the takedown of 34 servers in the Netherlands, Germany, Finland, France, Switzerland, Australia, the United States, and the United Kingdom.NetherlandsThis includes the takedown of 34 servers in the Netherlands, Germany, Finland, France, Switzerland, Australia, the United States, and the United Kingdom.PolandIn addition, two LockBit actors have been arrested in Poland and Ukraine at the request of the French judicial authorities. Three international arrest warrants and five indictments have also been issued by the FrenchSwitzerlandThis includes the takedown of 34 servers in the Netherlands, Germany, Finland, France, Switzerland, Australia, the United States, and the United Kingdom.UkraineIn addition, two LockBit actors have been arrested in Poland and Ukraine at the request of the French judicial authorities. Three international arrest warrants and five indictments have also been issued by the FrenchUnited KingdomThis includes the takedown of 34 servers in the Netherlands, Germany, Finland, France, Switzerland, Australia, the United States, and the United Kingdom.United StatesThis includes the takedown of 34 servers in the Netherlands, Germany, Finland, France, Switzerland, Australia, the United States, and the United Kingdom.