What actually happened with Operation Cronos?
Operation Cronos, publicly announced in February 2024 by the UK's National Crime Agency, the FBI, and Europol, took control of LockBit's leak sites and infrastructure, seized decryption keys, and exposed internal affiliate data. The operation was technically impressive: defacement of LockBit's own leak site, publication of victim lists with decrypt offers, and the release of a free decryptor for several LockBit 3.0 (Black) variants via the NoMoreRansom project.
Subsequent reporting in 2024 and into 2025 by the agencies involved, along with analysis by firms such as Trend Micro and Secureworks, described:
- Indictments and sanctions targeting named individuals, including the individual publicly identified as "LockBitSupp."
- Partial seizure of cryptocurrency wallets.
- Exposure of operational details including affiliate counts and internal chat logs.
That is a lot of disruption for one operation. What did it actually change on the defender side?
Did LockBit stop operating?
Answer first: no, not immediately and not cleanly.
Within days of the takedown, the LockBit brand attempted a relaunch with new infrastructure and new victim postings. Follow-on disclosures from law enforcement, including in subsequent months of 2024, released additional data suggesting the group's claims of resilience were partly theatre. Nonetheless, leak-site activity continued at reduced volume. What clearly degraded was trust: affiliates reportedly questioned whether LockBit's operators had retained as much decryption capability and as much victim-payment infrastructure as claimed.
That reputational hit, more than the infrastructure seizure, is probably the more durable outcome.
Where did the displaced affiliates go?
Public tracking by companies like Recorded Future, SOCRadar, and Coveware indicates that through 2024, affiliates displaced from LockBit and the roughly concurrent collapse of ALPHV/BlackCat (whose exit-scam was a separate 2024 event) showed up across:
- RansomHub, as noted in the CISA/FBI advisory AA24-242A.
- Play, Akira, Medusa, and other mid-tier RaaS programs.
- Brief standalone operations under pseudonymous brands.
None of these inherited LockBit's full technical stack. Several inherited the operators and their muscle memory. That matters because the operators carry the playbook - initial-access broker relationships, post-exploitation tooling, negotiation style - across brand changes.
Why does this redistribution matter for defenders?
Because the attributional picture got messier while the underlying threat stayed roughly the same. Three implications for 2026 planning:
- Attribution is even less actionable than before. Your incident response plan should not depend on knowing which brand is on the wall.
- TTPs are now cross-brand. Tools like EDRKillShifter, AuKill, Impacket wrappers, and living-off-the-land techniques appear across multiple programs. Detection engineering that targets tradecraft holds up; detection engineering that targets a specific brand's payload hash does not.
- The ecosystem is more fragmented but just as productive. Aggregate victim counts across all RaaS programs remained high through 2024 and into 2025. Disrupting one brand redistributes rather than eliminates.
What did the leaked affiliate data teach defenders?
The public NCA and FBI releases included information about affiliate numbers, payment arrangements, and internal communications. Useful takeaways:
- Affiliate counts were smaller than some vendor marketing had implied. The active, paying population was in the low hundreds, not thousands.
- Affiliate skill was unevenly distributed. Many intrusions were clumsy; a minority were operationally proficient and drove most of the damage.
- Negotiation tactics were templatized. Defenders should assume their incident will be handled with a script, not an individualized strategy.
The practical defender takeaway is that your detection capability does not need to match a nation-state. It needs to be decisively better than an average affiliate operating on borrowed tooling.
What should change in your 2026 ransomware preparedness?
- Immutable backup as a non-negotiable. Object-locked or WORM-configured backups stored under a separate identity and network trust domain. The ransomware groups have adapted; your backup posture has to assume admin-domain compromise.
- Revisit your IR retainer arrangements. Many IR firms were swamped in 2023-2024. Confirm response SLAs, confirm that your retainer covers cloud forensics if your environment is cloud-heavy, and run an exercise.
- Document a decision framework for extortion. Not a "will we pay" answer, but who approves, what data states require what escalation, who talks to counsel and regulators, who communicates with customers. This is painful to build mid-incident.
- Tabletop the "we have the decrypt key but data is leaked" scenario. Operation Cronos distributed decryptors; this has become more common. Double extortion means a free decrypt still leaves a data-leak problem.
What does the supply chain angle look like here?
LockBit's affiliates frequently entered through third parties. Public Accenture and Boeing disclosures associated with LockBit activity and the broader pattern of targeting managed service providers and software vendors are examples. The structural lesson holds: your ransomware risk is largely a third-party risk, and disrupting the leading RaaS brand does not fix that. It just reshuffles which affiliates are buying access from which brokers.
How should you read future law-enforcement disruptions?
With cautious optimism. Operation Cronos showed that coordinated international action can disrupt a leading program. Subsequent actions against RaaS infrastructure and against IABs (initial-access brokers) have compounded the pressure. But the economic incentives driving ransomware have not changed: payments still happen, cryptocurrency laundering still works well enough, and initial-access markets still commoditize the hardest technical step.
Plan as if the next takedown is a year of partial relief, not a permanent win.
What are the detection priorities that carry across brands?
Irrespective of whose logo is on the next leak site, these detections keep paying off:
- New local admin accounts created on domain controllers.
- Mass file-access patterns consistent with staging (e.g., robocopy or rclone to a new destination).
- Execution of BYOVD drivers not on your approved list.
- Remote-management tools appearing on systems that did not have them an hour ago.
- VSS shadow copy deletion, a nearly universal precursor across ransomware families.
These are brand-agnostic and have been for years. They should be your first tier of ransomware-specific detection engineering.
What did the seized affiliate data imply about initial-access economics?
The leaked affiliate records and subsequent law-enforcement commentary implied that many LockBit intrusions began with purchased access: VPN credentials, RDP footholds, and SSO tokens from initial-access brokers. Prices varied by target revenue and sector, but the economics were steady enough to sustain an active marketplace. This matters for defenders because it clarifies which control investments actually cut off the brokers' product: phishing-resistant MFA on remote access, mandatory rotation of remote-vendor credentials, decommissioning of orphaned VPN accounts, and continuous credential-leak monitoring against your own domains. None of those feel novel. All of them starve the broker economy that feeds affiliate programs.
How should third-party risk teams absorb the takedown lessons?
Stop treating "is this vendor LockBit-affected" as the meaningful question. The meaningful questions for 2026 are:
- Does the vendor have immutable backup that is isolated from their primary identity domain?
- Has the vendor tested its response to encryption-plus-exfiltration within the last 12 months?
- Does the vendor maintain an inventory of its own third parties with privileged access and verify their posture?
- Does the vendor's IR plan include a documented decision framework for extortion scenarios?
These four questions track the lessons from LockBit, BlackCat, Black Basta, and RansomHub more reliably than any brand-tracking spreadsheet. They also translate neatly into contractual language in new vendor agreements.
How Safeguard.sh Helps
Safeguard.sh treats the RaaS ecosystem as a moving supply chain threat, not a cluster of individual brands. We track affiliate migrations across programs, correlate exploitation activity back to the initial-access brokers feeding them, and map which of your third parties sit on appliance categories those affiliates are currently working. When a program like LockBit collapses and its affiliates redistribute, your exposure map updates automatically rather than waiting for a vendor deck six months from now. Disruption at the top end should reach defenders in days, not quarters.