Operation Cronos (February 2024 — LockBit Takedown)
eventIntelligence & Surveillance
Police seized a notorious ransomware gang's entire operation, and it was back online within two years.
Who they are
Operation Cronos, a February 2024 takedown of the LockBit ransomware group.
What they do
A coalition led by the UK's National Crime Agency and the FBI grabbed LockBit's core systems.
How it works
They seized its main admin environment, dark-web leak sites, source code, and over 1,000 decryption keys, yet LockBit reconstituted itself as version 5.0 by late 2025.
Why it matters
The engine treats it as evidence that even big takedowns rarely kill the underlying network; the criminals just tighten security, rewrite their software, and resume across scattered systems.
The engine's record — word for word
UK National Crime Agency + FBI + international coalition seized LockBit s primary administration environment, dark-web leak sites, source code, and 1,000+ decryption keys. Despite seizure, LockBit reconstituted as 5.0 by late 2025 — engine-canonical evidence that takedown operations rarely terminate underlying operational network; actors merely adapt opsec, iterate software, resume across distributed architectures.
Follow the trail
Walk this on the live map →