What was taken down?
34 servers seized across eight countries; source code and affiliate data obtained; more than 1,000 decryption keys recovered; more than 200 cryptocurrency wallets frozen; approximately 14,000 rogue accounts closed; leak site taken over and operated by law enforcement.[1][2][3][4]
See what happenedWhat happened to the people?
Officials reported 2 apprehended.
4 charged, 3 apprehended, 2 convicted, and 3 publicly wanted named in the public record.
Group accounted for: Members remain at large
Did it stay down?
After this action the service returned under the same operators, first seen February 2024. No later seizure of the replacement is recorded. High confidence in the link between the two.
See what happened afterwardUK National Crime Agency-led international task force that infiltrated and seized LockBit's primary administration environment and leak site, then repurposed the leak site to publish information about the group.[1][2][3][4]
Announced February 20, 2024.
- Date
- February 19 to February 20, 2024
- Target
- LockBit, ransomware as a service
- Activity
- Ransomware, Cryptocurrency laundering
- Operational lead
- NCA and FBI
- Partners
- Europol, USAO-DNJ, and 4 more[2][4]
- European Union Agency for Law Enforcement Cooperation , coordinator
- United States Attorney's Office for the District of New Jersey , charging
- European Union Agency for Criminal Justice Cooperation , judicial cooperation
- National Police Agency of Japan , technical partner
- Australian Federal Police , supporting
- Gendarmerie nationale , supporting
- Jurisdiction
- United Kingdom, United States, France, Germany, Switzerland, Japan, Australia, Sweden, Canada, Netherlands, Finland, Poland, and Ukraine
- Outcome
- 34 servers seized across eight countries; source code and affiliate data obtained; more than 1,000 decryption keys recovered; more than 200 cryptocurrency wallets frozen; approximately 14,000 rogue accounts closed; leak site taken over and operated by law enforcement.
- Status
- Completed
- Legal mechanism
- UK judicial process; US seizure warrants and indictments (District of New Jersey); Europol and Eurojust coordination; European Arrest Warrants
- Group accounted for
- Members remain at large
Infrastructure
34 servers seized, 1 onion service taken over, 200 cryptocurrency wallets frozen, and 14,000 user accounts disabled.
- 34
- servers seized
- 1
- onion service taken over
- more than 200
- cryptocurrency wallets frozen
| Identifier | Recorded as | Status | Notes |
|---|---|---|---|
| Not published | 34 servers | Seized | 34 servers seized across the Netherlands, Germany, Finland, France, Switzerland, Australia, the United Kingdom, and the United States.[1] |
| Not published | 1 onion service | Taken over | Leak site seized and repurposed by the task force to publish information about the group.[1] |
| Not published | more than 200 cryptocurrency wallets | Frozen | More than 200 cryptocurrency wallets linked to the group frozen.[1] |
| Not published | approximately 14,000 user accounts | Disabled | Approximately 14,000 rogue accounts on third-party services used for exfiltration and infrastructure were closed.[1] |
Domains and onion addresses are shown defanged. Where the record gives a count but no identifier, the count is shown in place of one. This list carries only what appears in the cited sources.
- 4
- charged
- 3
- apprehended
- 2
- convicted
- 3
- publicly wanted
Named in the public record: 4 charged, 3 apprehended, 2 convicted, and 3 publicly wanted.
Figures count individuals named in charging documents and official statements, each person once per outcome. People alleged to be involved but not publicly identified are not counted.
| Person | Role | Current public status |
|---|---|---|
| LockBit affiliate | ChargedPublicly wanted | |
|
||
| Creator, developer, and administrator of LockBit, operating as LockBitSupp | ChargedPublicly wantedSanctioned | |
|
||
| LockBit affiliate operating as Bassterlord | ChargedPublicly wanted | |
|
||
| Ransomware affiliate associated with LockBit, Babuk, and Hive | Charged | |
|
||
| LockBit affiliate | ArrestedSentencedPleaded guiltyExtradited | |
|
||
| Alleged LockBit developer | ArrestedExtradited | |
|
||
| LockBit affiliate | ArrestedPleaded guilty | |
|
||
Artur Sungatov
LockBit affiliate. Current public status: Charged and Publicly wanted.
- Charging authority
- United States Attorney's Office for the District of New Jersey
- Main charges
- Conspiracy to commit fraud, extortion and related activity in connection with computers
- Case number
- 24-80
- Arresting authority
- Not established in the public record
- Arrest location
- Not established in the public record
- Extradition status
- Not established in the public record
- Conviction or plea
- Not established in the public record
- Sentence
- Not established in the public record
- Segment
- Affiliate
- Sources
- [3]
- Full record
- Everything indexed for Artur Sungatov
Dmitry Yuryevich Khoroshev
Creator, developer, and administrator of LockBit, operating as LockBitSupp. Current public status: Charged, Publicly wanted, and Sanctioned.
- Charging authority
- United States Attorney's Office for the District of New Jersey
- Main charges
- Conspiracy to commit fraud, extortion and related activity in connection with computers; Conspiracy to commit wire fraud; Intentional damage to a protected computer; Extortion in relation to information obtained from a protected computer
- Case number
- 24-299
- Arresting authority
- Not established in the public record
- Arrest location
- Not established in the public record
- Extradition status
- Not established in the public record
- Conviction or plea
- Not established in the public record
- Sentence
- Not established in the public record
- Segment
- Core operator
- Sources
- [4]
Ivan Gennadievich Kondratyev
LockBit affiliate operating as Bassterlord. Current public status: Charged and Publicly wanted.
- Charging authority
- United States Attorney's Office for the District of New Jersey
- Main charges
- Conspiracy to commit fraud, extortion and related activity in connection with computers
- Case number
- 24-80
- Arresting authority
- Not established in the public record
- Arrest location
- Not established in the public record
- Extradition status
- Not established in the public record
- Conviction or plea
- Not established in the public record
- Sentence
- Not established in the public record
- Segment
- Affiliate
- Sources
- [3]
Mikhail Pavlovich Matveev
Ransomware affiliate associated with LockBit, Babuk, and Hive. Current public status: Charged.
- Charging authority
- United States Department of Justice
- Main charges
- Conspiracy to transmit ransom demands; Conspiracy to damage protected computers; Intentional damage to protected computers; Creation and use of malicious computer programs, per Russian media reports
- Case number
- Not established in the public record
- Arresting authority
- Not established in the public record
- Arrest location
- Not established in the public record
- Extradition status
- Not established in the public record
- Conviction or plea
- Not established in the public record
- Sentence
- Not established in the public record
- Segment
- Affiliate
- Sources
- [3]
- Full record
- Everything indexed for Mikhail Pavlovich Matveev
Mikhail Vasiliev
LockBit affiliate. Current public status: Arrested, Sentenced, Pleaded guilty, and Extradited.
- Charging authority
- Not established in the public record
- Main charges
- Not established in the public record
- Case number
- Not established in the public record
- Arresting authority
- Royal Canadian Mounted Police
- Arrest location
- Ontario, ON, Canada
- Extradition status
- Extradited
- Conviction or plea
- Pleaded guilty, July 18, 2024
- Sentence
- Approximately four years imprisonment
- Segment
- Affiliate
- Sources
- [3]
- Full record
- Everything indexed for Mikhail Vasiliev
Rostislav Panev
Alleged LockBit developer. Current public status: Arrested and Extradited.
- Charging authority
- Not established in the public record
- Main charges
- Not established in the public record
- Case number
- Not established in the public record
- Arresting authority
- Israel Police
- Arrest location
- Israel
- Extradition status
- Extradited, March 2025
- Conviction or plea
- Not established in the public record
- Sentence
- Not established in the public record
- Segment
- Developer
- Sources
- [3]
- Full record
- Everything indexed for Rostislav Panev
Ruslan Magomedovich Astamirov
LockBit affiliate. Current public status: Arrested and Pleaded guilty.
- Charging authority
- Not established in the public record
- Main charges
- Not established in the public record
- Case number
- Not established in the public record
- Arresting authority
- Federal Bureau of Investigation
- Arrest location
- Arizona, AZ, United States
- Extradition status
- Not established in the public record
- Conviction or plea
- Pleaded guilty, July 18, 2024
- Sentence
- Not established in the public record
- Segment
- Affiliate
- Sources
- [3]
Rows expand to show charging authority, case identifiers, custody status, and sources.
Group accounted for: Members remain at large
The core administrator Khoroshev was identified and charged but remains at large in Russia, as do at least two charged affiliates. The service relaunched within days, explicitly demonstrating remaining members.
A small core comprising the administrator LockBitSupp and at least one developer, surrounded by a large affiliate population that is a separate segment.
LockBit relaunched on new infrastructure within days; further charges and sanctions followed in May 2024.[1][2][3][4]
-
February 2024
LockBit relaunch and LockBit 4.0 and 5.0. Same operators. Confidence: High. No later seizure recorded.[1]
The administrator publicly relaunched a new leak site within five days of the takedown, attributing the compromise to an unpatched PHP vulnerability. Subsequent versions 4.0 and 5.0 were released under the same brand and administrator identity.
February 2024
LockBit relaunch and LockBit 4.0 and 5.0. Same operators. Confidence: High. No later seizure recorded.[1]
The administrator publicly relaunched a new leak site within five days of the takedown, attributing the compromise to an unpatched PHP vulnerability. Subsequent versions 4.0 and 5.0 were released under the same brand and administrator identity.
Return class B. The class is a research grading carried in the source dataset and its scale is not published, so this page relies on the relationship and confidence values instead. How this index handles it.
Numbered markers throughout this entry link to the source that supports the claim beside them.
Official sources
-
[1]
International investigation disrupts the world's most harmful cyber crime group
34 servers seized, decryption keys, wallet freezes, account closures, leak-site takeover, task force roster
-
[2]
Law enforcement disrupt world's biggest ransomware operation
Participating countries and coordination roles, Poland and Ukraine arrests
-
[3]
US Department of Justice announcements on LockBit charges and defendants
Charges against Sungatov, Kondratyev, Vasiliev, Astamirov, Panev, and Matveev; arrest and extradition history
-
[4]
United States v. Dmitry Yuryevich Khoroshev, Criminal No. 24-299
26-count indictment identifying LockBitSupp as Khoroshev; coordinated sanctions and reward
- Named person records span the February 2024 action and the connected May 2024 unsealing; the charging events are recorded with their own dates.
- Two individuals were arrested in Poland and Ukraine on the action date but were not publicly named, so they do not appear as person records.
- LockBit was reported to have extorted approximately 500 million USD from more than 2,500 victims.
- Post-takedown LockBit leak-site activity is widely assessed as inflated with recycled victim claims. Recorded as a source disagreement.