Category

# Ransomware takedowns

Actions against ransomware groups and the infrastructure they use to negotiate, leak, and collect payment.

Records 7 2021 to 2024

Infrastructure 9 Items recorded as acted on

People named 9 Distinct people in these records

Sources 14 Cited across the category

## What this category covers

Seizures of leak sites and negotiation panels, infiltrations that recovered decryption keys, and the charges brought against affiliates and administrators. Where an operation ran in waves, each wave is recorded separately.

Every entry below is an action that was carried out, not an announcement of intent. The [counting rules](https://takedownindex.org/about/counting-incidents) and the [inclusion definition](https://takedownindex.org/about/what-counts) apply to this category exactly as they apply to the rest of the index.

What the record does not settle

- 3 of 7 records have a documented successor. Silence in the other rows is not evidence that a service stayed down.
- 1 record carries no established start date.
- Reported figures come from the acting authorities. Named figures come from people recorded individually here. The two are never added together.

## Chronology

| Date | Takedown | Target | Led by | Jurisdictions |
| --- | --- | --- | --- | --- |
| Jan 27, 2021 | [NetWalker ransomware disruption](https://takedownindex.org/takedowns/netwalker-ransomware-disruption) | NetWalker | FBI | International |
| Jul 1, 2022 | [Hive ransomware infiltration and seizure](https://takedownindex.org/takedowns/hive-ransomware-infiltration-and-seizure) | Hive | FBI | International |
| Oct 20, 2023 | [Ragnar Locker disruption](https://takedownindex.org/takedowns/ragnar-locker-disruption) | Ragnar Locker | French Gendarmerie | Not established |
| Dec 19, 2023 | [ALPHV/BlackCat disruption](https://takedownindex.org/takedowns/alphv-blackcat-disruption) | ALPHV/BlackCat | FBI | Not established |
| Feb 19, 2024 | [Operation Cronos wave 1](https://takedownindex.org/takedowns/operation-cronos-wave-1) | LockBit | NCA and FBI | International |
| Aug 12, 2024 | [Radar/Dispossessor ransomware disruption](https://takedownindex.org/takedowns/radar-dispossessor-ransomware-disruption) | Radar (also known as Dispossessor) | FBI | Not established |
| Date not established | [Phobos/8Base ransomware disruption](https://takedownindex.org/takedowns/phobos-8base-ransomware-disruption) | Phobos and 8Base | Not established | Not established |

## Who leads these actions

- [FBI](https://takedownindex.org/organizations/federal-bureau-of-investigation)5 records
- [French Gendarmerie](https://takedownindex.org/organizations/gendarmerie-nationale)1 record
- [NCA](https://takedownindex.org/organizations/national-crime-agency)1 record

## Where they were carried out

- United States3 records
- Canada2 records
- Germany2 records
- Netherlands2 records
- Australia1 record
- Bulgaria1 record
- Switzerland1 record
- European Union1 record

A takedown is counted once for every country named in its geographic scope, so these figures sum to more than 7.

[Filter the full index by this category](https://takedownindex.org/takedowns?activity_type=ransomware)