A notorious cybercrime ring holding victims' data for ransom has been dismantled by the National Crime Agency (NCA) and a coalition of international police agencies.
A post on extortion website Lockbit on Monday said: “This website is now under the control of the UK National Crime Agency, working in close cooperation with the FBI and the international law enforcement task force, 'Operation Kronos.'
Europol and other international police organizations from France, Japan, Switzerland, Canada, Australia, Sweden, the Netherlands, Finland and Germany assisted in the rare law enforcement operation.
A spokesman for the National Crime Agency confirmed that the agency had disrupted the gang, and said that the operation was “continuous and evolving.”
A Lockbit representative posted messages on an encrypted messaging app saying it had backup servers that were not affected by law enforcement actions.
Lockbit is one of the most widespread and dominant ransomware operators in a highly competitive underground market.
The group and its affiliates have hacked some of the world's largest organizations in recent months. The gang makes money by stealing sensitive data and threatening to leak it if victims fail to pay a hefty ransom.
Its affiliates are like-minded criminal groups recruited to launch attacks using Lockbit's digital extortion tools.
Lockbit was discovered in 2020 when its malware was found on Russian-language cybercrime forums, leading some security analysts to believe the gang was based in Russia.
However, it has not declared its support for any government, nor has any government officially attributed it to a nation-state.
Please use Chrome browser for an easily accessible video player
From December: Russian cyber attacks: what we know
The group said on its now-defunct dark website that it “is located in the Netherlands, is completely apolitical and only cares about money.”
US officials described Lockbit as the world's biggest ransomware threat. The group has struck more than 1,700 organizations in the United States in nearly every industry from financial services and food to schools, transportation and government departments.
Read more:
The FBI disrupts a hacking network linked to Russian intelligence
Parents of gun violence victims in the US are using artificial intelligence to recreate their voices
FBI chief warns that Chinese hackers are preparing to 'wreak havoc' in the US
Royal Mail I experienced severe turbulence after Attack from Lockbit In early 2023.
Before its removal, Lockbit's website featured a growing gallery of victim organizations that was updated almost daily.
Next to their names were digital clocks showing the number of days remaining until each organization's deadline to make the ransom payment.
On Monday, the site showed a similar countdown, but from law enforcement agencies that wrote: “Check back here for more information at 11:30 GMT Tuesday, February 20.”
