LockBit

Also known as LockBitSupp (administrator)

For years the most prolific ransomware brand, renting its software to affiliates for a cut of each payment. Operation Cronos, led by the UK's National Crime Agency and the FBI, seized its servers in February 2024 and named its administrator three months later.

What it is
Ransomware-as-a-service
Based
Russian-speaking
Active
2019–
Status
Disrupted

On the record

  1. Oct 2024 · The Record

    UK names Evil Corp member Aleksandr Ryzhenkov as a LockBit affiliate, using data seized in Operation Cronos
  2. May 2024 · National Crime Agency

    LockBit's leader is unmasked as Dmitry Khoroshev and sanctioned by the UK, US and Australia; the US offers up to $10 million