ransomware-group-operationenforcement-actionthreat-infrastructure-trackingunderground-data-leak

Operation Cronos Crippled LockBit as Ransomware Tactics Shift to Stealthier Intrusions

Threat Actor Intelligence · 6 sources · Updated 3mo ago · First seen Jul 28, 2026

International law enforcement agencies said Operation Cronos disrupted LockBit, the ransomware-as-a-service group long described as the world’s most prolific ransomware operation. Authorities seized infrastructure, took control of LockBit’s leak site and platform, exposed affiliates, delivered decryption keys to victims, and publicly revealed that the group sometimes retained stolen victim data and failed to provide working decryptors. According to the FBI, LockBit operated from 2020 to 2024, hit more than 2,500 organizations in at least 120 countries, and collected more than $500 million in ransom payments; several members have since been arrested or charged, while alleged leader Dmitry Yuryevich Khoroshev remains indicted, sanctioned, and at large.

Know this adversaryTTPs, infrastructure, and targeting history in one profile.

Get the profile

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

8 events · 2020 – 2026

Reported Jul 27, 20263mo ago
US sanctions and indicts alleged LockBit leader
The US Department of Justice sanctioned and indicted alleged LockBit leader Dmitry Yuryevich Khoroshev, who remained at large at the time of reporting.
FBI: Breaking Affiliate Trust Sped Along LockBit's Takedown
Reported Jul 27, 20263mo ago
Key LockBit members are arrested or charged
After the takedown, several key LockBit members were arrested or charged, while alleged leader Dmitry Yuryevich Khoroshev remained at large.
FBI: Breaking Affiliate Trust Sped Along LockBit's Takedown
2026
Ransomware encrypts thousands of files across multiple systems
The early 2026 intrusion culminated in ransomware deployment that encrypted thousands of files across multiple systems, with SMB-based propagation noted in Darktrace's reporting.
What the OpenAI and Hugging Face Incident Means for Defenders
2026
Attackers exfiltrate data to Wasabi before ransomware deployment
During the same early 2026 intrusion, Darktrace observed outbound transfers to Wasabi cloud storage, including more than 200 MB of data, consistent with double-extortion tactics before encryption.
What the OpenAI and Hugging Face Incident Means for Defenders
2026
Darktrace detects ransomware intrusion using stolen VPN credentials
In early 2026, Darktrace observed a multi-stage ransomware intrusion in a customer environment that began with compromised VPN credentials and progressed over several days through reconnaissance, privilege escalation, lateral movement, command-and-control, and data exfiltration.
What the OpenAI and Hugging Face Incident Means for Defenders
Feb 2024
Authorities provide LockBit decryption keys to victims
Following the February 2024 takedown, law enforcement delivered decryption keys to LockBit victims as part of the disruption effort.
FBI: Breaking Affiliate Trust Sped Along LockBit's Takedown
2020
LockBit operates as a ransomware-as-a-service group
According to the FBI, LockBit operated from 2020 to 2024, targeting more than 2,500 organizations in at least 120 countries and collecting over $500 million in ransom payments.
FBI: Breaking Affiliate Trust Sped Along LockBit's Takedown
Date unknown
Operation Cronos seizes LockBit infrastructure
In February 2024, the FBI, the UK National Crime Agency, Europol, and partners seized LockBit infrastructure, took control of its leak site and platform, and used that access to expose affiliates and undermine trust in the operation.
Law enforcement disrupt world’s biggest ransomware operation - LockBit was the most deployed ransomware variant across the world | Europol

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →

Threat actors

1 linked

LockBit

Malware

1 linked

LockBit

Observables

8 linked

IPv4 address•••.••.•••.•••Domain•••••••.ruMD5 hash••••••••••••••••••••••••••••••••IPv4 address•••.•••.••.•••Domain••••••••••.comIPv4 address•••.•••.••.•••Domain••••••••••••.comIPv4 address•••.•••.••.•••

Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.

Do you run this?See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.

Get the Full Actor Profile

Source coverage

Sources

6 references tracked. Mallory keeps watching after this page renders.

ScworldNews · Jul 28, 2026

Operation Cronos dismantled LockBit ransomware group by undermining affiliate trust | brief | SC MediaOpen source ↗

Darktrace BlogNews · Jul 27, 2026

Uncovering a Multi-Stage Ransomware Attack Through Behavioral DetectionOpen source ↗

Dark ReadingNews · Jul 27, 2026

FBI: Breaking Affiliate Trust Sped Along LockBit's TakedownOpen source ↗

Darktrace BlogNews · Jul 24, 2026

When Guardrails Break: Why Securing AI Requires Behavioral Detection and Autonomous ContainmentOpen source ↗

Darktrace BlogNews · Jul 22, 2026

What the OpenAI and Hugging Face Incident Means for DefendersOpen source ↗

EuropolNews

Law enforcement disrupt world’s biggest ransomware operation - LockBit was the most deployed ransomware variant across the world | EuropolOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News