Operation Cronos
NCA-led international operation that seized LockBit ransomware infrastructure in February 2024.
When European police took the KillSec ransomware leak site on 30 September 2026, the precedent was Operation Cronos, Britain's February 2024 takeover of LockBit's systems and leak site.
Last refreshed: 12 October 2026
Why did LockBit survive losing its leak site to police?
Timeline for Operation Cronos
Named as Operation Cronos
Cybersecurity: Threats and Defences: Mentioned in: Police seize KillSec ransomware leak siteMentioned in: New '2019' group tops June ransomware tally
Cybersecurity: Threats and DefencesMentioned in: Saffron raid takes down First VPN
Cybersecurity: Threats and DefencesBackground
Operation Cronos was an international law-enforcement action in which Britain's National Crime Agency (NCA), working with the FBI, seized control of the LockBit ransomware group's systems and its leak site in February 2024. Ten countries took part.
Announcing the operation on 20 February 2024, the NCA said it held LockBit's administration environment and source code. It had obtained more than 1,000 decryption keys for victims, taken down 28 servers used by affiliates and frozen over 200 Cryptocurrency accounts. Europol coordinated two arrests, one in Poland and one in Ukraine, and US prosecutors unsealed indictments against two Russian nationals.
LockBit put up a new leak site within about a week, but affiliates lost trust in the brand and its claimed victims fell through 2024. Ransomware volumes as a whole recovered within months, because LockBit's affiliates moved to other brands.