The LockBit story: Why the ransomware affiliate model can turn takedowns into disruptions
Summary: The NCA, working with the FBI and partners from nine other countries under Operation Cronos, infiltrated LockBit's network on Feb. 20, 2024 and took control of the group's primary administration environment, which affiliates used to build attacks and host its dark web leak site. At least three LockBit affiliates were arrested in Poland and Ukraine and more than 200 cryptocurrency accounts linked to the group were frozen, yet seven days after the operation LockBit published messages and leak data on a new page listing both pre- and post-takedown victims.
Why it matters: LockBit's RaaS model recruited unconnected affiliates who move between groups following the money, so arrests of a few members and a seized admin environment did not stop the operation - Talos says LockBit is still accepting affiliates and its leaders evaded arrest. Talos also recorded a 17% rise in ransomware incidents in the last quarter, with its incident response team handling Play, Cactus, BlackSuit and NoEscape for the first time.
Read the original at Cisco Talos ↗
- Topics
- Cybercrime & Law Enforcement
- Related
- Gootloader Malware Disrupted After Infecting 25,000 Computers Cyber Risks · Nov 13, 2026354 dark web vendors and buyers arrested in Operation Tor Nado Cyber Risks · Nov 13, 2026Law Enforcement Disrupts Gootloader, CastleRAT, and StealC Infrastructure Cyber Risks · Nov 13, 2026