Law enforcement release

# International investigation disrupts the world's most harmful cyber crime group

National Crime Agency, February 20, 2024. 34 servers seized, decryption keys, wallet freezes, account closures, leak-site takeover, task force roster.

**Source type:** Law enforcement release

**Published:** February 20, 2024

**Research grade:** P1

**Used in entries:** 9

## Bibliographic record

**Publisher:** National Crime Agency

**Published:** February 20, 2024

**Source type:** Law enforcement release

**Research grade:** Source grade P1

**Language:** English

**Official record:** Official publication

**Address:** No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher.

**What it supports:** 34 servers seized, decryption keys, wallet freezes, account closures, leak-site takeover, task force roster

**Dataset id:** src\_nca\_cronos\_2024

## Research notes

- URL not re-verified in this pass.

How this source is used

Cited 9 times across 4 record types.

The role on each citation records what the source was relied on for. A primary source establishes the fact, a supporting source corroborates it, technical evidence describes the infrastructure, and a later outcome records what happened afterwards.

Sources were reviewed to a research cutoff of August 20, 2026. Addresses recorded after that date are not reflected here.

## Cited by

### Takedown records

2 citations

Cited on the takedown record itself.

-
[Operation Cronos wave 1](https://takedownindex.org/takedowns/operation-cronos-wave-1)

Ransomware, February 2024

Primary source
-
[Operation Cronos](https://takedownindex.org/takedowns/operation-cronos)

Ransomware, February 2024

Primary source

### Organization roles

2 citations

Cited for an organization's recorded role in a takedown.

-
[National Crime Agency](https://takedownindex.org/takedowns/operation-cronos-wave-1)

Operational lead, Operation Cronos wave 1

Primary source
-
[Federal Bureau of Investigation](https://takedownindex.org/takedowns/operation-cronos-wave-1)

Co-lead, Operation Cronos wave 1

Primary source

### Infrastructure

4 citations

Cited for infrastructure recorded as acted on.

-
[34 servers](https://takedownindex.org/takedowns/operation-cronos-wave-1)

Servers seized, Operation Cronos wave 1

Primary source
-
[1 onion service](https://takedownindex.org/takedowns/operation-cronos-wave-1)

Onion service taken over, Operation Cronos wave 1

Primary source
-
[more than 200 cryptocurrency wallets](https://takedownindex.org/takedowns/operation-cronos-wave-1)

Cryptocurrency wallets frozen, Operation Cronos wave 1

Primary source
-
[approximately 14,000 user accounts](https://takedownindex.org/takedowns/operation-cronos-wave-1)

User accounts disabled, Operation Cronos wave 1

Primary source

### Later activity

1 citation

Cited for activity recorded after the takedown.

-
[LockBit relaunch and LockBit 4.0 and 5.0](https://takedownindex.org/takedowns/operation-cronos-wave-1)

Same operators, Operation Cronos wave 1

Primary source

[All sources](https://takedownindex.org/sources)