FBI: Operation Cronos Undermined LockBit Trust to Achieve Takedown
The FBI revealed that a key strategy in dismantling the LockBit ransomware group was eroding trust between the RaaS operator and its affiliates, crippling its operations.
Operation Cronos, a significant multinational law enforcement effort, successfully disrupted the LockBit ransomware-as-a-service (RaaS) operation, a group that had become a dominant force in cybercrime. At its peak, LockBit was responsible for approximately a quarter of all ransomware attacks globally, operating primarily between 2020 and 2024. According to Brett Leatherman, assistant director of the FBI's Cyber Division, the group victimized over 2,500 organizations across more than 120 countries, with a substantial portion, over 1,800 attacks, occurring in the United States. LockBit's illicit activities generated more than $500 million in ransom payments, and its leader, identified as Russian national Dmitry Yuryevich Khoroshev, appeared to be untouchable.
Leatherman described LockBit's RaaS enterprise as "the most successful criminal business in the world" for a period. By the time of its disruption in February 2024, the group had cultivated a network of nearly 200 affiliates who carried out the actual attacks. Khoroshev profited by taking a 20% cut from every dollar of ransom earned by these affiliates.
The turning point came with Operation Cronos, a coordinated international law enforcement action that seized LockBit's infrastructure, including its leak site, control panel, and source code. This operation, part of the broader Operation Endgame effort, inflicted permanent damage on the group's reputation and operational capabilities. Law enforcement gained control of LockBit's servers and was able to provide decryption keys to victims, offering them a path to recovery.
A critical element of Operation Cronos's success, as highlighted by Leatherman and Paul Foster, deputy director of the UK's National Crime Agency (NCA), was the deliberate strategy to break the trust relationship between LockBit and its affiliates. These affiliates had been promised anonymity and long-term success, making trust the core commodity LockBit sold. By exploiting LockBit's own leak site, law enforcement exposed the affiliates, creating a rift in these crucial partnerships.
"Trust is what ransomware-as-a-service actually sells," Leatherman explained. "An affiliate hands the platform his access, his malware builds, his negotiations, and his money and what he buys in return is anonymity and a payday." Following the seizure of LockBit's infrastructure, law enforcement posted countdown clocks on the leak site and revealed the identities of affiliates, sending a clear message: "We know who they are and we will be watching." Furthermore, evidence from LockBit's own servers revealed that the group had failed to delete victim data as promised and that some victims had received faulty decryptors, further eroding affiliate confidence.
Leatherman emphasized that simply targeting the group's technical capabilities was insufficient; damaging LockBit's credibility was essential for a lasting impact. "A criminal enterprise can rebuild a server in a day, but rebuilding trust is a much harder problem," he stated. Concurrently, law enforcement agencies focused on building strong trust and partnerships among themselves, a collaboration that was described as "genuinely rare" at the time. Foster concurred, noting that "The collaboration of all agencies was inevitably key" to the operation's success, with each agency leveraging its unique skills.
While some remnants of LockBit's operations may persist, key members have been arrested or charged, significantly diminishing the group's standing. Khoroshev remains at large but faces charges and a $10 million reward for information leading to his arrest. Two and a half years after Operation Cronos, LockBit is considered a minor player, "significantly degraded in impact and credibility." The ransomware landscape has shifted from having a single dominant force like LockBit to a more fragmented environment with no single strain holding sway.
Statistics from Chainalysis indicate a substantial decrease in LockBit's activity, with average attacks in the UK falling by 73% and a similar decline in the US. Ransom payments in the US attributed to LockBit dropped by 79% in the latter half of 2024. Law enforcement agencies have integrated key lessons from this operation into future investigations, particularly recognizing "reputation as an operational asset" and understanding that centralized infrastructure, while efficient, can also be a single point of failure that can be exploited by adversaries, including law enforcement.