LockBit Ransomware is a ransomware-as-a-service operation that encrypts victims’ systems, steals sensitive data, and threatens publication to pressure organisations into paying. On 20 February 2024, the NCA-led Operation Cronos significantly disrupted LockBit by seizing its infrastructure, source code, and decryption keys, alongside arrests and international enforcement actions. However, LockBit attempted to rebuild during 2025, showing that organisations still require layered defences, strong access controls, network segmentation, endpoint monitoring, and protected offline backups.
Disruption of LockBit Ransomware Cartel
News that the prolific, dangerous and feared LockBit ransomware cartel has been significantly disrupted by the UK’s National Crime Agency (NCA), the FBI and others, has been welcomed by the cyber security community.
Operation Cronos: Disclose the Covert Endeavor
Operation Cronos, which has been quietly unfolding over a period of several months, saw the NCA and partners compromise the gang’s infrastructure and seize assets including servers, bespoke tools, and dark websites used by the operation and its affiliates.
Financial Clampdown: Freezing Cryptocurrency Accounts
The authorities have also frozen a number of cryptocurrency accounts linked to the LockBit gang, and we now know that two people have been taken into police custody in Poland and Ukraine.
Future Uncertainties and Proactive Measures
In response to this development, our CEO Camellia Chan shared with Computer Weekly: “We can’t expect the gang that hit ICBC [China’s largest bank] with a cyber attack so bad it disrupted the US treasury market to go down without a fight. LockBit could even re-invent itself in time, as we’ve seen with other ransomware gang rebrands. Plus, there’s no doubt there are other threat actors just around the corner. For businesses, this should be a wake-up call to bolster defences.”
Her advice? “To meet the fast-evolving threat landscape, organisations need to be proactive in recognising security gaps and must address those with innovative, proven solutions at both the software and the hardware layer”.
Take pre-emptive action against cybercriminals, contact us to learn more about our firmware and hardware-based data protection solutions today.
Read responses from Camellia and other experts in the industry in these articles by:
