The U.K. National Crime Agency (NCA) has confirmed the successful takedown of LockBit ransomware’s infrastructure. This comes after an international law enforcement operation resulted in the seizure of multiple darknet domains operated by LockBit, one of the most prolific ransomware groups.
Operation Cronos, as the operation is codenamed, saw authorities from 11 countries, including the U.S., the U.K., and Australia, working alongside Europol to take down LockBit’s .onion websites. Visitors to the group’s websites are now greeted with a seizure banner stating that the sites are under the control of law enforcement.
The operation was made possible by exploiting a critical security flaw impacting PHP that allowed for remote code execution, according to malware research group VX-Underground. In a blow to LockBit’s operations, law enforcement agencies stated that they have gained access to the group’s “source code, details of the victims, the amount of money extorted, the data stolen, chats, and much more,” thanks to the group’s “flawed infrastructure.”
LockBit, which has been one of the most active and notorious ransomware gangs, has claimed over 2,000 victims and extorted at least $91 million from U.S. organizations alone. According to cybersecurity firm ReliaQuest, LockBit listed 275 victims on its data leak portal in the fourth quarter of 2023. While there is no news of arrests or sanctions yet, this takedown is a significant setback for LockBit and comes on the heels of the dismantling of the BlackCat ransomware operation by the U.S. government two months ago. This action also comes at the same time as the arrest of a 31-year-old Ukrainian national for unauthorized access to Google and online bank accounts, showing a broader trend of crackdowns on cybercriminal activities.