Active Defense & Deception
,
Black Hat
,
Cybercrime
FBI’s Brett Leatherman and UK NCA’s Paul Foster on Takedowns, Cybercrime Disruption
LockBit once accounted for roughly one-fifth to one-fourth of ransomware activity, giving law enforcement a rare opportunity to disrupt a major share of the cybercrime ecosystem. The response – Operation Cronos – which combined technical disruption, enforcement and victim support, said Brett Leatherman, assistant director of the Cyber Division at the FBI, and Paul Foster, deputy director of the National Cyber Crime Unit at the U.K. National Crime Agency.
See Also: AI Phishing Now Frighteningly Normal, Hard to Detect
The cyber-disruption campaign brought together 11 countries to seize LockBit infrastructure, expose affiliates and prioritize victims. “When we conducted it in February of 2024, it was impactful to that environment. Within two months, we saw … over 80% reductions in ransomware attacks against victims – a result of Cronos,” Leatherman said.
Careful sequencing helped law enforcement partners act when their combined capabilities could deliver the greatest and most lasting impact, undermining trust across the LockBit ecosystem. “The number of message exchanges and urgent phone calls that underpinned all of that was huge. It was genuinely a multinational collaboration,” Foster said.
In this video interview with ISMG at Black Hat USA 2026, Leatherman and Foster also discussed:
- How decryption keys denied ransom revenue while supporting victims;
- Why publicly naming LockBit’s leader caused more damage than the indictment;
- How public-private threat intelligence helps law enforcement target shared cybercrime infrastructure.
Leatherman leads FBI’s efforts to disrupt sophisticated cyber adversaries targeting U.S. interests while supporting victims of cyberattacks. He previously served in several roles in FBI’s Dallas Cyber Division, including as assistant special agent in charge for national security, overseeing teams focused on counterterrorism and cyberthreat investigations.
Foster leads the National Crime Agency’s cybercrime operations and helps shape U.K. law enforcement response to cybercrime. He previously held intelligence, covert operations and counterterrorism leadership roles with the West Midlands Police.
