News Reaction: Global Law Enforcement Unite to Take Down Notorious Ransomware Group LockBit RaaS

Yesterday, an online site belonging to notorious ransomware gang LockBit RaaS Group was taken over by global law enforcement, including The National Crime Agency (NCA), FBI, and Europol, as part of 'Operation Cronos'.

The message "This site is now under the control of the National Crime Agency of the UK, working in close cooperation with the FBI and the international law enforcement task force, 'Operation Cronos'" was posted on the group's extortion website on Monday evening in an "ongoing" and "developing" operation.

First discovered in 2020, LockBit RaaS has been the most prolific and aggressive ransomware group across the threat landscape for the last two years. Responsible for several high-profile attacks, including The Royal Mail and Boeing, the Group works by holding its victim's data to ransom.

Following yesterday's advances in coordinating global efforts against a common threat, Matt Hull, Global Head of Threat Intelligence at NCC Group, comments: 

"The law enforcement intervention against the LockBit RaaS Group is perhaps the most significant over the last three years. In 2023, NCC Group's Threat Intelligence Team recorded 1039 LockBit victims, equating to 22% of all ransomware victims identified for the whole year.

"LockBit RaaS has been used in cyber-attacks against organisations around the globe and has impacted virtually every region and economic sector, including big names such as The Royal Mail and Boeing.

"We have previously talked about the need for governments and law enforcement agencies to combine their efforts to tackle the threat from Ransomware. This is an excellent example of what can be achieved when there is a coordinated effort against a common threat.

"No doubt people will be wondering whether LockBit can bounce back. The Group has claimed that they have back-ups of their systems and data. We have seen in the past various ransomware operators re-brand, join forces with other Groups, or come back a few months later. We will get a better idea over the coming days and weeks to the full extent of Operation Cronos and the future capabilities of the LockBit Group."

For more information on LockBit and exclusive insights into the latest cyber threat intelligence, read our Monthly Threat Reports and Annual Threat Monitor, or sign up for our Monthly Threat Intel Webinars.