Skip to main content
Back to the takedown index

Operation Cronos

February 2024, Ransomware

Verified core entry, last reviewed August 21, 2026

Umbrella campaign. This entry groups 1 recorded action. Infrastructure, people, and sources sit on each wave rather than on this entry, so read the waves for what was taken down and who was held to account.

Wave Date Lead Outcome
Operation Cronos wave 1 February 19 to February 20, 2024 NCA and FBI 34 servers seized across eight countries; source code and affiliate data obtained; more than 1,000 decryption keys recovered; more than 200 cryptocurrency wallets frozen; approximately 14,000 rogue accounts closed; leak site taken over and operated by law enforcement.

Ongoing NCA-led international task force against the LockBit ransomware operation, comprising the February 2024 infrastructure seizure and subsequent charging, sanctions, and disclosure actions.[1]

Announced February 20, 2024.

Date
February 2024
Target
LockBit, campaign
Activity
Ransomware
Operational lead
Not established
Jurisdiction
United Kingdom, United States, European Union, Australia, Japan, and Canada
Outcome
See child incidents.
Status
Ongoing
Legal mechanism
See child incidents.
Group accounted for
Not applicable

No individual is named against this entry in the cited record. That is a gap in what has been published rather than a finding that nobody was involved.

Group accounted for: Not applicable

Campaign-level record.

Not applicable at campaign level.

Task force remained active through the cutoff.[1]

Not established in the public record. No later activity is recorded against this entry.

Return class G. The class is a research grading carried in the source dataset and its scale is not published, so this page relies on the relationship and confidence values instead. How this index handles it.

Numbered markers throughout this entry link to the source that supports the claim beside them.

Official sources

  1. [1]
    International investigation disrupts the world's most harmful cyber crime group

    National Crime Agency, February 20, 2024, Source grade P1

    34 servers seized, decryption keys, wallet freezes, account closures, leak-site takeover, task force roster

    No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher.

Coverage note.
  • Excluded from incident totals. Child in this pass: td_2024_cronos_w1.
  • The May 2024 Khoroshev unsealing and sanctions are recorded as person_actions against the wave 1 incident rather than as a separate infrastructure incident, because no new infrastructure action was involved.