{
  "id": 17442231,
  "title": "How police hacked LockBit, the world's biggest ransomware gang",
  "url": "https://urgent.news/2026/10/31/how-police-hacked-lockbit-the-worlds-biggest-ransomware-gang",
  "topic": "world",
  "section": "World",
  "published": "2026-10-31T17:42:04.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/kstriabintang/how-police-hacked-lockbit-the-worlds-biggest-ransomware-gang-24ne"
  },
  "original_language": "en",
  "account": "In February 2024, international police forces launched a coordinated operation called \"Cronos\" to take down LockBit, the world's most prominent ransomware gang. The operation was led by the National Crime Agency (NCA) in the UK, in collaboration with the FBI, Europol, and law enforcement agencies in around ten countries. The primary objectives of the operation were to seize LockBit's servers, take control of its leak site, obtain decryption keys, and gather intelligence on the gang's affiliates and attack methods.\n\nLockBit, which emerged around 2019, operated as a franchise model, with a core team building and maintaining the ransomware, while affiliates deployed it in targeted attacks. The group was responsible for more than 2,000 victimizations and received over $120 million in ransom payments. LockBit's operations included a leak site, where victims' stolen data was listed and threatened to be published unless ransom was paid. The group also offered a bug bounty for information leading to the identity of its leader, LockBitSupp, who offered a $10 million reward for his exposure.\n\nDuring the operation, police seized LockBit's administrative environment and leak site, seized servers and cryptocurrency accounts, and obtained decryption keys for victims. They also revealed the identity of LockBitSupp, who turned out to be Dmitry Khoroshev, a Russian national. The police published details about the operation, mocked LockBitSupp, and announced the identity reveal, effectively breaking the trust between the gang and its affiliates. One crucial discovery was that LockBit had kept data from victims who had paid, contradicting their promise to delete the stolen data upon payment.\n\nAfter the operation, LockBit attempted to re-establish its presence with new infrastructure and aggressive messaging. However, its reputation suffered, and affiliates moved to other ransomware groups. The operation demonstrated that even the most formidable ransomware gang is vulnerable to targeted attacks that disrupt their business model. The most effective defense against ransomware attacks is to close vulnerabilities that allow affiliates to infiltrate organizations, maintaining reliable backups, and reporting incidents to authorities.",
  "summary": "Ransomware gangs love a leak site. It is their shop window: a dark-web page listing victims, a countdown clock, and a threat to publish stolen data unless the ransom is paid. In February 2024, visitors to LockBit's leak site found something new on the page. The logos of the UK's National Crime Agency , the FBI and a long list of international police forces. The site had been seized. And the…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}