International law enforcement operation in February 2024 that partially dismantled the LockBit ransomware group's infrastructure and identified 194 affiliates.
Operation Cronos is an international law enforcement operation coordinated by the British National Crime Agency and Europol, with participation from ten countries including the United States, France, Germany, Australia, Japan and Canada, whose results were made public on 20 February 2024. It led to the seizure of 34 servers used by the LockBit group to host its command-and-control infrastructure, data leak sites and affiliate management panels, the seizure of over 200 cryptocurrency wallets, the arrest of two members in Poland and Ukraine, and the indictment of five individuals in the United States and United Kingdom. Authorities also temporarily took control of LockBit's leak site to display an ironic message redirecting victims to their own decryption tools. The operation produced an immediate market effect: global ransom payments fell 35 percent in 2024. However, LockBit attempted to reconstitute under version 4.0, and several of its affiliates migrated to competing groups such as RansomHub and Akira, illustrating the structural resilience of a decentralized criminal market. For the insurance industry, Cronos constitutes a case study on the measurability and timing of law enforcement operations' effects on cyber loss experience.
The seizure of LockBit servers allowed authorities to identify 194 active affiliates and recover over 7,000 decryption keys. Past victims who had not yet paid were able to recover their data for free via a tool posted online by the FBI and NCA, a rare case of direct beneficial impact for insureds in the context of a dismantlement operation.
Operation Cronos, Cronos