Skip to content
OriginalSign in
Image: Dark Reading

Dark ReadingElizabeth Montalbano

FBI's Operation Cronos Disrupts LockBit, Ends $500M Ransom Era

Part of the LockBit story · since 8 Oct 2025

Quiet for 13 weekslast report 3 Aug9 articles8 outlets
8 Oct · The Hacker News first20 Apr25 Jun30 AugNowThis article8th of 9
  • Wed 8 Oct, 13:45 UTC. The Hacker News, first report. LockBit, Qilin, and DragonForce Join Forces to Dominate the Ransomware Ecosystem.
  • Wed 8 Oct, 19:20 UTC. Security Affairs, its first report on the story. DragonForce, LockBit, and Qilin, a new triad aims to dominate the ransomware landscape.
  • Wed 8 Oct, 19:50 UTC. DataBreaches, its first report on the story. DragonForce, LockBit, and Qilin, a new triad aims to dominate the ransomware landscape.
  • Thu 9 Oct, 06:45 UTC. GBHackers, its first report on the story. Data-Leak Sites Surge to Record Levels Amid Scattered Spider RaaS and LockBit 5.0 Rise.
  • Tue 23 Dec, 01:25 UTC. SecurityOnline, its first report on the story. A Desperate Cartel: Inside the Unlikely Alliance of Qilin, DragonForce, and a Fading LockBit.
  • Tue 21 Apr, 17:48 UTC. Dark Reading, its first report on the story. Bomgar CVE-2026-1731 Exploited in Supply Chain, LockBit Deployed. Cites a CVE in CISA KEV.
  • Sun 3 May, 10:00 UTC. Krebs on Security, its first report on the story. LockBit’s Fulton County ransom bluff falls after FBI seizure.
  • Mon 27 Jul, 21:21 UTC. Dark Reading. FBI's Operation Cronos Disrupts LockBit, Ends $500M Ransom Era. This article, 8th of 9.
  • Mon 3 Aug, 13:11 UTC. Securelist, its first report on the story. Brazilian schools hit by ransomware as LockBit builder leaks.

The FBI's Operation Cronos successfully dismantled the LockBit ransomware group by undermining its affiliate trust and utilizing strong international partnerships. LockBit, operational from 2020 to 2024, victimized over 2,500 organizations globally and collected more than $500 million in ransom. The FBI targeted LockBit's centralized operations, disrupting its infrastructure and exposing affiliates who had been misled about their anonymity and safety.

The operation significantly damaged the group’s reputation, making it difficult for them to regain credibility. Key lessons from the takedown include viewing reputation as a crucial asset in cybercriminal enterprises and adapting law enforcement strategies to counteract the decentralization of such operations. Despite some LockBit elements remaining active, the group's overall impact has decreased significantly.

How the story developed

All 9 articles
Quiet for 13 weekslast report 3 Aug9 articles8 outlets

9 articles from 8 outlets since 8 Oct. Quiet since 3 Aug. This was the 8th report, 292 days after the first.

Now8 Oct31621518 Apr24 JulFirst reportThe Hacker News · 8 Oct, 13:45This article8th of 9 · day 292Exploited CVEDark Reading · 21 Apr
  • Wed 8 Oct, 13:45 UTC. The Hacker News, first report. LockBit, Qilin, and DragonForce Join Forces to Dominate the Ransomware Ecosystem.
  • Wed 8 Oct, 19:20 UTC. Security Affairs, its first report on the story. DragonForce, LockBit, and Qilin, a new triad aims to dominate the ransomware landscape.
  • Wed 8 Oct, 19:50 UTC. DataBreaches, its first report on the story. DragonForce, LockBit, and Qilin, a new triad aims to dominate the ransomware landscape.
  • Thu 9 Oct, 06:45 UTC. GBHackers, its first report on the story. Data-Leak Sites Surge to Record Levels Amid Scattered Spider RaaS and LockBit 5.0 Rise.
  • Tue 23 Dec, 01:25 UTC. SecurityOnline, its first report on the story. A Desperate Cartel: Inside the Unlikely Alliance of Qilin, DragonForce, and a Fading LockBit.
  • Tue 21 Apr, 17:48 UTC. Dark Reading, its first report on the story. Bomgar CVE-2026-1731 Exploited in Supply Chain, LockBit Deployed. Cites a CVE in CISA KEV.
  • Sun 3 May, 10:00 UTC. Krebs on Security, its first report on the story. LockBit’s Fulton County ransom bluff falls after FBI seizure.
  • Mon 27 Jul, 21:21 UTC. Dark Reading. FBI's Operation Cronos Disrupts LockBit, Ends $500M Ransom Era. This article, 8th of 9.
  • Mon 3 Aug, 13:11 UTC. Securelist, its first report on the story. Brazilian schools hit by ransomware as LockBit builder leaks.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 9 articles as a list
  1. Wed 8 OctDay 03
    1. LockBit, Qilin, and DragonForce Join Forces to Dominate the Ransomware Ecosystem13:45 · The Hacker News · First report
    2. DragonForce, LockBit, and Qilin, a new triad aims to dominate the ransomware landscape19:20 · Security Affairs
    3. DragonForce, LockBit, and Qilin, a new triad aims to dominate the ransomware landscape19:50 · DataBreaches
  2. Thu 9 OctDay 11
    1. Data-Leak Sites Surge to Record Levels Amid Scattered Spider RaaS and LockBit 5.0 Rise06:45 · GBHackers

  3. Quiet for 11 weeks

    Tue 23 DecDay 761
    1. A Desperate Cartel: Inside the Unlikely Alliance of Qilin, DragonForce, and a Fading LockBit01:25 · SecurityOnline · Picked up again

  4. Quiet for 17 weeks

    Tue 21 AprDay 1951
    1. Bomgar CVE-2026-1731 Exploited in Supply Chain, LockBit Deployed17:48 · Dark Reading · Exploited CVE · Picked up again · Known exploited CVE

  5. Quiet for 12 days

    Sun 3 MayDay 2071
    1. LockBit’s Fulton County ransom bluff falls after FBI seizure10:00 · Krebs on Security · Picked up again

  6. Quiet for 12 weeks

    Mon 27 JulDay 2921
    1. FBI's Operation Cronos Disrupts LockBit, Ends $500M Ransom Era21:21 · Dark Reading · Picked up again · This article, 8th of 9

  7. Quiet for 7 days

    Mon 3 AugDay 2991
    1. Brazilian schools hit by ransomware as LockBit builder leaks13:11 · Securelist · Picked up again

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in