Category
Ransomware takedowns
Actions against ransomware groups and the infrastructure they use to negotiate, leak, and collect payment.
What this category covers
Seizures of leak sites and negotiation panels, infiltrations that recovered decryption keys, and the charges brought against affiliates and administrators. Where an operation ran in waves, each wave is recorded separately.
Every entry below is an action that was carried out, not an announcement of intent. The counting rules and the inclusion definition apply to this category exactly as they apply to the rest of the index.
What the record does not settle
- 3 of 7 records have a documented successor. Silence in the other rows is not evidence that a service stayed down.
- 1 record carries no established start date.
- Reported figures come from the acting authorities. Named figures come from people recorded individually here. The two are never added together.
Chronology
| Date | Takedown | Target | Led by | Jurisdictions |
|---|---|---|---|---|
| Jan 27, 2021 | NetWalker ransomware disruption | NetWalker | FBI | International |
| Jul 1, 2022 | Hive ransomware infiltration and seizure | Hive | FBI | International |
| Oct 20, 2023 | Ragnar Locker disruption | Ragnar Locker | French Gendarmerie | Not established |
| Dec 19, 2023 | ALPHV/BlackCat disruption | ALPHV/BlackCat | FBI | Not established |
| Feb 19, 2024 | Operation Cronos wave 1 | LockBit | NCA and FBI | International |
| Aug 12, 2024 | Radar/Dispossessor ransomware disruption | Radar (also known as Dispossessor) | FBI | Not established |
| Date not established | Phobos/8Base ransomware disruption | Phobos and 8Base | Not established | Not established |
Who leads these actions
- FBI 5 records
- French Gendarmerie 1 record
- NCA 1 record
Where they were carried out
- United States 3 records
- Canada 2 records
- Germany 2 records
- Netherlands 2 records
- Australia 1 record
- Bulgaria 1 record
- Switzerland 1 record
- European Union 1 record
A takedown is counted once for every country named in its geographic scope, so these figures sum to more than 7.