LockBit: Europol Coordinates Four New Arrests

The third phase of Operation Cronos led, notably, to the arrest by French authorities of a developer from the ransomware gang.

On October 1, 2024, Europol announced that it had coordinated new actions against the Russian-speaking ransomware gang LockBit, which led to four arrests. This third phase of Operation Cronos involved Eurojust and 12 countries: Germany, Australia, Canada, Spain, the United States, France, Japan, the Netherlands, Romania, the United Kingdom, Sweden, and Switzerland.

As part of the operation, French authorities arrested a suspected developer of LockBit while he was on vacation outside of Russia. Meanwhile, Spanish law enforcement seized nine servers that were part of the ransomware infrastructure and arrested an administrator of a “bulletproof” hosting service used by the group. The British police apprehended two affiliates of the ransomware gang.

Australia, the United States, and the United Kingdom also implemented sanctions against a “prolific affiliate” of LockBit. This individual is reportedly strongly linked to Evil Corp, a major Russian cybercriminal group, which was also targeted in this third phase of Cronos. The UK sanctioned 15 more Russian nationals for their involvement with Evil Corp, while the US sanctioned six, and Australia sanctioned two.

Founded in 2019 by Russian nationals, LockBit was the world’s number one ransomware gang in 2022 and 2023. In February 2024, the first phase of Cronos hit the group’s infrastructure, resulting in the seizure of its showcase website and several arrests. In May 2024, a second wave led to financial sanctions, further seizures, and additional arrests.

Europol noted that Cronos has also helped develop decryption tools for machines infected by the ransomware. While less prolific, LockBit remains active: its affiliates continue to target organizations, primarily in the West.