← Back to Blog
Technology & Cybersecurity by Loffa Interactive Group

Operation Cronos: The LockBit Takedown and What Followed

Pruning shears lie on the grass beneath a cut ivy stem as the vine withers off a stone wall at dusk.

Illustration of law enforcement taking apart the LockBit ransomware operation

Updated October 2026. First published November 2024.

In February 2024, LockBit's leak site stopped showing stolen victim files and started showing a seizure notice. The U.K. National Crime Agency (NCA), working with the FBI and an international task force, had taken control of LockBit's primary administration environment, the system its affiliates used to build and launch attacks, along with the public leak site. In the same operation, called Operation Cronos, the NCA took the group's source code and about 1,000 decryption keys.

We wrote about the takedown twice in 2024, and this post replaces both. It covers what LockBit was, what it did to a U.S. broker-dealer, what happened after February 2024, and what operations and security teams at a broker-dealer should take from it.

What LockBit Was

LockBit sold ransomware as a service. Its developers rented the software to affiliates, who broke into networks, stole data, encrypted systems, and split the ransom with the group. Treasury calls the method double extortion: the affiliate steals data before it encrypts the systems, then demands payment.

The numbers were large before the takedown. A June 2023 joint advisory from CISA, the FBI, and partner agencies counted about 1,700 LockBit attacks in the United States since the first one was seen there on January 5, 2020, and about $91 million in U.S. ransom payments. By May 2024, the Justice Department put the worldwide total at more than 2,500 victims and more than $500 million in ransom.

The Broker-Dealer Case

For this audience, the LockBit attack that matters most hit the U.S. broker-dealer of the Industrial and Commercial Bank of China (ICBC) on November 9, 2023. Treasury's February 2024 sanctions release describes the result plainly. The attack caused a blackout of ICBC's computer systems and a loss of email and communications. It affected the settlement of more than $9 billion of assets backed by Treasury securities. Because ICBC couldn't reach its own systems, securities were delivered for settlement with no funds backing the trades.

That last detail is the one to keep. Ransomware at one firm became a settlement problem for the firms on the other side of its trades. Your continuity plan probably covers your own outage. It should also say what your desk does when a counterparty goes dark with trades in flight. Our post on the January 2024 EquiLend outage looks at the same problem when the firm that goes dark is a vendor.

What Happened After February 2024

The takedown was the first step in a longer effort. The main public steps since:

  • On February 20, 2024, the Justice Department unsealed an indictment in New Jersey charging two Russian nationals, Artur Sungatov and Ivan Kondratyev, with deploying LockBit. Treasury sanctioned both the same day.
  • On May 7, 2024, the United States, the United Kingdom, and Australia named Dmitry Yuryevich Khoroshev as "LockBitSupp," the group's administrator and developer, and sanctioned him. The Justice Department indicted him, and the State Department offered a reward of up to $10 million. Treasury said he had led the effort to restart LockBit after the February disruption.
  • In March 2025, Israel extradited Rostislav Panev, an alleged LockBit developer arrested there in August 2024, to face charges in New Jersey.

LockBit tried to come back after Cronos, and the affiliates who rented its software kept their skills. What the operation did was damage the brand, name the people behind it, and give some victims a way to decrypt their systems without paying. It didn't end ransomware, and the controls below matter as much now as they did in 2023.

What to Take From It

The techniques LockBit's affiliates used are still the ones to guard against. CISA's advisory lists the usual ways in: exposed remote desktop, phishing, stolen or brute-forced credentials, and flaws in internet-facing applications. In November 2023, a second CISA advisory showed LockBit affiliates exploiting Citrix Bleed (CVE-2023-4966), a flaw in NetScaler ADC and Gateway appliances that let attackers hijack valid sessions and skip both passwords and multifactor authentication.

Four things follow for a broker-dealer:

  1. Patch remote-access and other internet-facing devices first. VPN concentrators and gateways are where many of these attacks start. A VPN device was also the way in for the 2021 ICE intrusion that the SEC settled in 2024.
  2. Assume a stolen session can get past multifactor authentication. After you patch a device like this, end the active sessions and look for logins that don't fit.
  3. Write down what your desk does if a counterparty or platform disappears mid-settlement: who calls whom, what gets booked by hand, and how you reconcile afterward.
  4. Check your incident response program against the amended Regulation S-P, which requires notice to affected customers within 30 days of a qualifying breach. Our post on settlement instruction fraud and the 2024 Regulation S-P amendments covers those rules.

If your firm was a LockBit victim and never recovered its data, ask the FBI. In 2024 it asked U.S. victims to contact it through its Internet Crime Complaint Center (IC3) about keys recovered in Cronos.

← All Posts