The third phase of Operation Cronos, which involved officers from the UK National Crime Agency (NCA), the FBI, Europol and other law enforcement agencies, has resulted in the arrest of four persons for allegedly participating in the LockBit ransomware-as-a-service operation in various roles. In February 2024, in the first public stage of Operation Cronos, the authorities took over LockBit gang’s leak site and revealed that they’ve managed to take control of LockBit’s platform and affiliate panel, which gave them insight into victims and affiliates. “A suspected developer of LockBit was arrested at the request of the French authorities, while the British authorities arrested two individuals for supporting the activity of a LockBit affiliate,” Europol announced on Tuesday. Simultaneously, Australia, the UK and the US announced sanctions against Aleksandr Ryzhenkov, a Russian national believed to be a prolific affiliate of LockBit and strongly linked to Evil Corp, and other individuals and entities associated with Evil Corp. In May 2024, the second stage of the operation resulted in the unmasking of LockBitSupp, the suspected creator and administator of the LockBit ransomware-as-a-service outfit, as Russian national Dmitry Khoroshev. The US Department of Treasury’s and NCA’s press releases and a NCA whitepaper provide more insight into the Evil Corp group’s functioning throughout the years, the identities of some suspected core members, and the group’s close links with the Russian state. Two Russian nationals were indicted for conspiring to commit LockBit attacks, and two suspected LockBit affiliates were arrested in Poland and Ukraine. In March 2024, a dual Canadian-Russian national arrested in late 2022 was sentenced for committing cyber crimes as part of the LockBit group. “Europol facilitated the information exchange, supported the coordination of the operational activities and provided operational analytical support, as well as crypto tracing and forensic support,” the EU law enforcement agency explained.
This Cyber News was published on www.helpnetsecurity.com. Publication date: Wed, 02 Oct 2024 10:13:06 +0000