Lockbit disrupted by law enforcement in ‘Operation Cronos’ | #cybercrime | #infosec

In a significant move against cyber-crime, the UK’s National Crime Agency (NCA), along with a coalition of international law enforcement agencies took over Lockbit’s extortion website late on Monday night (19 February). 

A post on the cybercriminal group’s website read: “This site is now under the control of the National Crime Agency of the UK, working in close cooperation with the FBI and the international law enforcement task force, ‘Operation Cronos’.”

Lockbit emerged as one of the dominant ransomware operators in the underground cyber-crime market, specialising in extorting money from victims by threatening to leak data obtained through hacking. 

The crackdown, Operation Cronos,  involved coordination with Europol and numerous other international police organisations from France, Japan, Switzerland, Canada, Australia, Sweden, the Netherlands, Finland, and Germany, marks a rare collaborative effort to tackle cybercrime on a global scale.

While the law enforcement agencies have taken control of Lockbit’s website, visitors are directed to return for further updates at 11:30 GMT on Tuesday, 20th of February.

Its affiliated groups, which execute attacks using Lockbit’s tools, have targeted some of the world’s largest organisations in recent months. Notably, in just September last year the group leaked about 10 gigabytes of sensitive data from a West Midlands-based Military of Defence (MoD) contractor Zaun.

Recommended

Lockbit also attacked the software provider Ion Group, a company that plays a key role in the underbelly of trading, debt, and derivatives in Square Mile and around the world. The attack had a knock-on effect, leading to other trade processing systems to process trades manually. 

Earlier in the same month, Lockbit hit Royal Mail last year, and around 11,500 Post Office branches were unable to handle international mail or parcels. While the disruption lasted roughly six weeks, according to TechCrunch, the 45 gigabyte data dump published from the attack by LockBit did not contain much sensitive customer or financial information.

When looking at data leaks in 2023, research from WithSecure revealed that Lockbit accounted for the biggest share of them at 21%. US officials have identified Lockbit as the foremost ransomware threat globally, with over 1,700 organisations in the US alone falling victim to its attacks across various sectors. 

Related