LockBit
Cybercriminal group that operated the most prolific ransomware-as-a-service network between 2019 and 2024, before its partial dismantlement by Operation Cronos.
On 11 January 2023 Royal Mail suspended its international shipments after a LockBit attack; the group demanded about $80 million and then published the data. LockBit is the name of a cybercriminal group and its eponymous ransomware strain that dominated the ransomware-as-a-service market for more than four years. Emerging in late 2019 under the name ABCD then rebranded LockBit, the group successively developed LockBit 2.0 (2021) and LockBit 3.0 aka Black (2022), the latter sharing similarities with the BlackMatter and BlackCat ransomware. At its peak, LockBit claimed more than 2,000 identified victims and is reported to have collected over 120 million dollars in ransoms. Its RaaS business model was particularly sophisticated: affiliate management panels, integrated negotiation service, double-extortion data leak site, and even a bug bounty program for researchers identifying vulnerabilities in its own code. Operation Cronos, coordinated by Europol and the British National Crime Agency in February 2024, led to the seizure of 34 servers, the identification of 194 affiliates and the arrest of several members. The disruption caused an immediate contraction in global ransom payments, illustrating the systemic weight of an actor concentrating a significant share of criminal supply. For cyber actuaries, LockBit constituted a reference scenario for correlation and frequency models for large-scale ransomware losses.
In February 2024, at the takedown, the authorities spoke of more than 2,000 victims. In May 2024, when it indicted Dmitry Khoroshev, named as the group's leader, the US Department of Justice raised the count to more than 2,500 victims in at least 120 countries, including 1,800 in the United States, among them hospitals, critical infrastructure and public administrations. According to the National Crime Agency, the five most affected countries between June 2022 and February 2024 were the United States, the United Kingdom, France, Germany and China.
LockBit, LockBit 2.0, LockBit 3.0, LockBit Black
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.