[Back to the takedown index](https://takedownindex.org/takedowns)

# Operation Cronos

February 2024, Ransomware

Source linked. Verified August 21, 2026.

Umbrella campaign. This entry groups 1 recorded action. Infrastructure, people, and sources sit on each wave rather than on this entry, so read the waves for what was taken down and who was held to account.

## Waves in this campaign

| Wave | Date | Lead | Outcome |
| --- | --- | --- | --- |
| [Operation Cronos wave 1](https://takedownindex.org/takedowns/operation-cronos-wave-1) | February 19 to February 20, 2024 | NCA and FBI | 34 servers seized across eight countries; source code and affiliate data obtained; more than 1,000 decryption keys recovered; more than 200 cryptocurrency wallets frozen; approximately 14,000 rogue accounts closed; leak site taken over and operated by law enforcement. |

## What happened

Ongoing NCA-led international task force against the LockBit ransomware operation, comprising the February 2024 infrastructure seizure and subsequent charging, sanctions, and disclosure actions.[[1]](#source-1)

Announced February 20, 2024.

**Date:** February 2024

**Target:** LockBit, campaign

**Activity:** Ransomware

**Operational lead:** Not established

**Jurisdiction:** United Kingdom, United States, European Union, Australia, Japan, and Canada

**Outcome:** See child incidents.

**Status:** Ongoing

**Legal mechanism:** See child incidents.

**Group accounted for:** Not applicable

## People and accountability

No individual is named against this entry in the cited record. That is a gap in what has been published rather than a finding that nobody was involved.

Group accounted for: Not applicable

Campaign-level record.

Not applicable at campaign level.

## What happened afterward

Task force remained active through the cutoff.[[1]](#source-1)

Not established in the public record. No later activity is recorded against this entry.

Return class G. The class is a research grading carried in the source dataset and its scale is not published, so this page relies on the relationship and confidence values instead. [How this index handles it](https://takedownindex.org/about).

## Sources

Numbered markers throughout this entry link to the source that supports the claim beside them.

### What each part of this entry rests on

The audit recorded which sources carry which part of the record. These are those sources.

- Identity, dates and counts, [[1]](#source-1) [International investigation disrupts the world's most harmful cyber crime group](https://takedownindex.org/sources/national-crime-agency-international-investigation-disrupts-the-world-s-most-harm)

### Official sources

1.
[International investigation disrupts the world's most harmful cyber crime group](https://takedownindex.org/sources/national-crime-agency-international-investigation-disrupts-the-world-s-most-harm)

National Crime Agency, February 20, 2024, Source grade P1

34 servers seized, decryption keys, wallet freezes, account closures, leak-site takeover, task force roster

[Open source](https://www.nationalcrimeagency.gov.uk/news/nca-leads-international-investigation-targeting-worlds-most-harmful-ransomware-group)

Coverage note.
- Excluded from incident totals. Child in this pass: td\_2024\_cronos\_w1.
- The May 2024 Khoroshev unsealing and sanctions are recorded as person\_actions against the wave 1 incident rather than as a separate infrastructure incident, because no new infrastructure action was involved.

Research context

## How this entry was checked

Source linked

Every claim in this entry traces to a source the audit opened and read. Nothing on the record needed changing.

Verified: August 21, 2026

Sources cited: 1

Research cutoff: August 21, 2026

Limitations recorded against this entry

- Campaign-level record; personnel and legal outcomes belong to child incidents and are not independently counted here.

See also

[About the Internet Takedown Index](https://takedownindex.org/about)

Related entries

- [Operation Cronos wave 1](https://takedownindex.org/takedowns/operation-cronos-wave-1)
- [ALPHV/BlackCat disruption](https://takedownindex.org/takedowns/alphv-blackcat-disruption)
- [Ragnar Locker disruption](https://takedownindex.org/takedowns/ragnar-locker-disruption)

Report updates or corrections

Help keep this record accurate.

[Submit feedback](https://takedownindex.org/about/corrections-and-updates)