Skip to content
←Back to glossaryCyber

Operation Cronos

International law enforcement operation in February 2024 that partially dismantled the LockBit ransomware group's infrastructure and identified 194 affiliates.

Definition

On 19 February 2024, visitors to LockBit's leak site no longer found victims but a banner from the National Crime Agency: the site had been seized. Operation Cronos is an international law enforcement operation coordinated by the British National Crime Agency and Europol, with ten countries including the United States, France, Germany, Australia, Japan and Canada. Results were made public on 20 February 2024. It allowed authorities to seize 34 servers LockBit used to host its command-and-control infrastructure, data leak sites and affiliate management panels, freeze over 200 cryptocurrency accounts, and arrest two members in Poland and Ukraine. French and US judicial authorities issued five indictments. For several days the NCA posted its own announcements on that site, and on 7 May 2024 it named the group's alleged leader, Dmitry Khoroshev. The market effect was immediate: global ransom payments fell about 35 percent in 2024 according to Chainalysis, which attributes the decline to law enforcement actions, sanctions and victims' growing refusal to pay. LockBit still tried to rebuild under version 4.0, and several of its affiliates moved to competing groups such as RansomHub and Akira. A decentralized criminal market absorbs this kind of blow. For the insurance industry, Cronos is a case study in how to measure the effects of law enforcement operations on cyber loss experience, and when those effects show up.

Its 5 cross-references, woven across the glossary's 18 categories
Operation Cronos: Cyber glossary illustration, AlgoPolis
Example

The seizure of LockBit servers allowed authorities to identify 194 active affiliates and recover over 1,000 decryption keys (more than 7,000 according to the FBI in June 2024). Some victims recovered their data for free, using tools developed by the Japanese police, the NCA and the FBI and made available on the No More Ransom portal. A rare case where a dismantlement operation directly benefits insureds.

Read next
CyberLockBitCybercriminal group that operated the most prolific ransomware-as-a-service network between 2019 and 2024, before its partial dismantlement by Operation Cronos.Read the entry →CyberRansomware as a Service (RaaS)A cybercriminal business model in which operators rent a turnkey ransomware kit to affiliates in exchange for a share of the ransom.Read the entry →CyberBig game huntingA ransomware strategy focusing exclusively on large organizations capable of paying very high ransoms.Read the entry →
Put it to work
QuizModule check: sanctions and ransomAcademy questions on this concept, each one marked and explained.Test yourself →SimulatorPlay this case from the underwriter's seatEight quarters, one book, cyber and political risk files. You set the price and the war clause, then the market answers back.Take the seat →
Related terms
Related articles
#05Ransomware as a Financial Asset
Go further at the Academy
Course · CY-2One event or several?QuizAnatomy of an attack, from entry to exfiltrationQuizCyber war, attribution and sanctions
Also known as

Operation Cronos, LockBit takedown

Stay informed

Follow the research

One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.

No spam, one-click unsubscribe, no data ever sold.