Multinational police effort hits sections of Lockbit ransomware operation | CyberScoop<\/title> <meta name=\"description\" content=\"Law enforcement announced arrests, seizures, and infrastructure takedowns as part of the effort.\"> <link rel=\"canonical\" href=\"https:\/\/cyberscoop.com\/lockbit-arrests-ransomware-fbi-uk-nca-evil-corp\/\"> <meta property=\"og:locale\" content=\"en_US\"> <meta property=\"og:type\" content=\"article\"> <meta property=\"og:title\" content=\"Multinational police effort hits sections of Lockbit ransomware operation\"> <meta property=\"og:description\" content=\"Law enforcement announced arrests, seizures, and infrastructure takedowns as part of the effort.\"> <meta property=\"og:url\" content=\"https:\/\/cyberscoop.com\/lockbit-arrests-ransomware-fbi-uk-nca-evil-corp\/\"> <meta property=\"og:site_name\" content=\"CyberScoop\"> <meta property=\"article:published_time\" content=\"2024-10-01T14:33:11+00:00\"> <meta property=\"article:modified_time\" content=\"2024-10-01T14:52:16+00:00\"> <meta property=\"og:image\" content=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/multinational-police-effort-hits-sections-of-lockbit-ransomware-operation-1.png\"> <meta property=\"og:image:width\" content=\"1910\"> <meta property=\"og:image:height\" content=\"1288\"> <meta property=\"og:image:type\" content=\"image\/png\"> <meta name=\"author\" content=\"AJ Vicens\"> <meta name=\"twitter:card\" content=\"summary_large_image\"> <meta name=\"twitter:creator\" content=\"@AJVicens\">  <link rel=\"dns-prefetch\" href=\"\/\/securepubads.g.doubleclick.net\">\n<link rel=\"dns-prefetch\" href=\"\/\/use.typekit.net\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Feed\" href=\"https:\/\/cyberscoop.com\/feed\/\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Comments Feed\" href=\"https:\/\/cyberscoop.com\/comments\/feed\/\"> <link rel=\"stylesheet\" id=\"all-css-2\" href=\"https:\/\/cyberscoop.com\/wp-includes\/css\/dist\/block-library\/style.min.css?m=1725982252g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-6\" href=\"https:\/\/cyberscoop.com\/wp-content\/mu-plugins\/search\/elasticpress\/dist\/css\/related-posts-block-styles.min.css?m=1727795050g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-8\" href=\"https:\/\/cyberscoop.com\/wp-content\/themes\/scoopnewsgroup\/dist\/css\/frontend.css?m=1727364714g\" type=\"text\/css\" media=\"all\">\n<link rel=\"stylesheet\" id=\"typekit-css\" href=\"https:\/\/use.typekit.net\/itk2qbh.css?ver=ada0ad45b21fc79c6694\" media=\"all\"> <link rel=\"https:\/\/api.w.org\/\" href=\"https:\/\/cyberscoop.com\/wp-json\/\"><link rel=\"alternate\" title=\"JSON\" type=\"application\/json\" href=\"https:\/\/cyberscoop.com\/wp-json\/wp\/v2\/posts\/81989\"><link rel=\"EditURI\" type=\"application\/rsd+xml\" title=\"RSD\" href=\"https:\/\/cyberscoop.com\/xmlrpc.php?rsd\">\n<meta name=\"generator\" content=\"WordPress 6.6.2\">\n<link rel=\"shortlink\" href=\"https:\/\/cyberscoop.com\/?p=81989\">\n<link rel=\"alternate\" title=\"oEmbed (JSON)\" type=\"application\/json+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Flockbit-arrests-ransomware-fbi-uk-nca-evil-corp%2F\">\n<link rel=\"alternate\" title=\"oEmbed (XML)\" type=\"text\/xml+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Flockbit-arrests-ransomware-fbi-uk-nca-evil-corp%2F&format=xml\">   <link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=32\" sizes=\"32x32\">\n<link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=192\" sizes=\"192x192\">\n<link rel=\"apple-touch-icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=180\">\n<meta name=\"msapplication-TileImage\" content=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=270\"> <\/head><body class=\"post-template-default single single-post postid-81989 single-format-standard\" id=\"readabilityBody\"> <a href=\"https:\/\/cyberscoop.com\/lockbit-arrests-ransomware-fbi-uk-nca-evil-corp\/#main\" class=\"skip-to-content-link visually-hidden-focusable\">Skip to main content<\/a> <\/p>\n<div class=\"ad ad--top ad--top-desktop\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p> <main id=\"main\" role=\"main\" tabindex=\"-1\"> <\/p>\n<div class=\"ad ad--top ad--top-mobile\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<section id=\"stickybar\" class=\"stickybar stickybar--event js-stickybar\">\n<div class=\"stickybar__details\" readability=\"4.952380952381\">\n<div class=\"stickybar__info js-sticky-bar-content\" readability=\"32\">\n<p>Voting is open for the 2024 CyberScoop 50 awards! <\/p>\n<\/div>\n<p> <a class=\"stickybar__link button button-tertiary\" href=\"https:\/\/cyberscoop.com\/cyberscoop50\/vote\/\">Click here!<\/a> <\/div>\n<p> <button class=\"stickybar__close js-stickybar-close\" aria-controls=\"stickybar\"> <svg class=\"icon icon--close\" width=\"21\" height=\"22\" viewBox=\"0 0 21 22\" fill=\"none\"><path d=\"m.822.518-.805.805L9.695 11 .017 20.678l.805.805 9.678-9.678 9.677 9.678.806-.805L11.305 11l9.678-9.677-.806-.805-9.677 9.677L.822.518Z\" fill=\"currentColor\" \/><\/svg> <span class=\"visually-hidden\">Close<\/span> <\/button> <\/section>\n<article class=\"single-article content\">\n<div class=\"single-article__container js-single-article-content\">\n<header class=\"single-article__header \" readability=\"25.751824817518\">\n<div class=\"single-article__header-content\" readability=\"30.92380952381\">\n<ul class=\"single-article__eyebrow\">\n<li class=\"single-article__category\"> <a class=\"single-article__category-link\" href=\"https:\/\/cyberscoop.com\/news\/threats\/cybercrime\/\"> <span>Cybercrime<\/span> <\/a> <\/li>\n<\/ul>\n<p> Law enforcement announced arrests, seizures, and infrastructure takedowns as part of the effort. <\/p>\n<\/p><\/div>\n<div class=\"single-article__cover-wrap\">\n<figure class=\"single-article__cover\"> <img data-recalc-dims=\"1\" fetchpriority=\"high\" width=\"640\" height=\"432\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/multinational-police-effort-hits-sections-of-lockbit-ransomware-operation.png?resize=640%2C432&ssl=1\" class=\"single-article__cover-image wp-post-image\" alt decoding=\"async\" fetchpriority=\"high\" srcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/multinational-police-effort-hits-sections-of-lockbit-ransomware-operation-1.png 1910w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/multinational-police-effort-hits-sections-of-lockbit-ransomware-operation-1.png?resize=300,202 300w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/multinational-police-effort-hits-sections-of-lockbit-ransomware-operation-1.png?resize=768,518 768w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/multinational-police-effort-hits-sections-of-lockbit-ransomware-operation-1.png?resize=1024,691 1024w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/multinational-police-effort-hits-sections-of-lockbit-ransomware-operation-1.png?resize=1536,1036 1536w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/multinational-police-effort-hits-sections-of-lockbit-ransomware-operation-1.png?resize=600,405 600w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/multinational-police-effort-hits-sections-of-lockbit-ransomware-operation-1.png?resize=249,168 249w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/multinational-police-effort-hits-sections-of-lockbit-ransomware-operation-1.png?resize=500,337 500w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/multinational-police-effort-hits-sections-of-lockbit-ransomware-operation-1.png?resize=1001,675 1001w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/multinational-police-effort-hits-sections-of-lockbit-ransomware-operation-1.png?resize=1250,843 1250w\" sizes=\"(max-width: 1001px) 100vw, 1001px\"><figcaption> The front page of the law enforcement-controlled website formerly used by LockBit to post target data, captured Oct. 1, 2024, after the announcement of additional actions against LockBit. (CyberScoop) <\/figcaption><\/figure>\n<\/p><\/div>\n<\/header>\n<div class=\"single-article__content\">\n<div class=\"single-article__content-inner has-drop-cap\"> <html readability=\"30.907407407407\"><body readability=\"62.720046082949\"><\/p>\n<p>An international consortium of law enforcement agencies on Tuesday announced additional arrests, seizures and sanctions targeting LockBit ransomware infrastructure, the latest actions taken to hobble what was once among the most prolific ransomware operations going.<\/p>\n<p>The actions include four arrests, seized servers and sanctions targeting an affiliate working with LockBit who authorities say has links to <a href=\"https:\/\/cyberscoop.com\/tag\/evil-corp\/\">Evil Corp<\/a>., an erstwhile Russian-based cybercrime syndicate <a href=\"https:\/\/home.treasury.gov\/news\/press-releases\/sm845\">sanctioned by the U.S. government in 2019<\/a> for its role in distributing malware and enabling a range of cybercriminal activity.<\/p>\n<p>The <a href=\"https:\/\/cyberscoop.com\/dridex-begat-doj-indictment-russians-arrested\/\">U.S. Department of Justice also in 2019<\/a> indicted two people associated with Evil Corp., Maksim Yakubets and Igor Turashev. <\/p>\n<p>Authorities on Tuesday said they arrested a suspected LockBit developer in France, two people in the U.K. who were allegedly supporting the activity of a LockBit affiliate, and the administrator of a bulletproof hosting service in Spain that worked with the LockBit group. <\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>The <a href=\"https:\/\/www.gov.uk\/government\/news\/uk-sanctions-members-of-notorious-evil-corp-cyber-crime-gang-after-lammy-calls-out-putins-mafia-state\">U.K. sanctioned 16 people Tuesday<\/a> accused of being members of Evil Corp., and released detailed information on the history of the group and its connections to past and present cybercriminal activity. Among the sanctioned is Aleksandr Ryzhenkov, who the <a href=\"https:\/\/x.com\/NCA_UK\/status\/1841119712119316840\">U.K.\u2019s National Crime Agency<\/a> identified as a LockBit affiliate and as \u201cYakubets\u2019 right-hand man.\u201d<\/p>\n<p>The <a href=\"https:\/\/www.justice.gov\/opa\/pr\/russian-national-indicted-series-ransomware-attacks\">DOJ unsealed an indictment against Ryzhenkov<\/a> on Tuesday, alleging that he participated in ransomware attacks across the U.S. dating back to 2017, according to a statement. Additionally, the U.S. Treasury Department sanctioned Ryzhenkov, along with six other people and two entities associated with Evil Corp.<\/p>\n<p><span><\/span><span><\/span>Australia was also set to announce its own sanctions related to the operation, according to a <a href=\"https:\/\/www.europol.europa.eu\/media-press\/newsroom\/news\/lockbit-power-cut-four-new-arrests-and-financial-sanctions-against-affiliates\">statement from Europol<\/a>, which assisted the 12-country operation.<\/p>\n<p>Tuesday\u2019s actions are the latest salvo against LockBit taken under \u201cOperation Cronos,\u201d the name of the <a href=\"https:\/\/www.nationalcrimeagency.gov.uk\/news\/nca-leads-international-investigation-targeting-worlds-most-harmful-ransomware-group\">organized international effort<\/a> led by the NCA unveiled in February 2024. British authorities seized the website used by LockBit to post targets and share data from targeted entities that refused to pay ransom and used it as the platform to disseminate news about the operation and information about the nearly 200 affiliates working with LockBit at the time, part of both a traditional law enforcement disruption as well as a <a href=\"https:\/\/cyberscoop.com\/lockbit-takedown-messaging-campaign\/\">psychological operation<\/a> designed to undermine LockBit\u2019s support in the cybercrime community. <\/p>\n<p>The FBI did not provide an immediate response to requests for comment Tuesday morning.<\/p>\n<p>Authorities also identified Dmitry Yuryevich Khoroshev as the driving force behind LockBit and said the Russian national controlled the \u201cLockBitSupp\u201d persona, which communicated with journalists and researchers about LockBit\u2019s operations. The DOJ <a href=\"https:\/\/www.justice.gov\/opa\/media\/1350921\/dl?inline\">indicted Khoroshev<\/a> at the time, accusing him of running the operation that targeted more than 2,000 victims and extorting more than $100 million in ransom payments since it began operation in September 2019.<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>LockBitSupp <a href=\"https:\/\/cyberscoop.com\/us-uk-authorities-unmask-russian-national-as-lockbit-administrator\/\">told CyberScoop at the time<\/a> that authorities had identified the wrong person and vowed to continue working. LockBit did transition to new infrastructure and appeared to be targeting new victims in the wake of the February disruption. <\/p>\n<p>The authorities who seized LockBit\u2019s site eventually made it inaccessible, but the site came back online Monday promising new information about arrests and further disruptions. <\/p>\n<p><\/body> <\/p>\n<footer class=\"single-article__footer\" readability=\"1.0731225296443\">\n<div class=\"author-card\" readability=\"8\">\n<div class=\"author-card__avatar\">\n<figure class=\"author-card__image-wrap\"> <img data-recalc-dims=\"1\" decoding=\"async\" class=\"author-card__image\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/multinational-police-effort-hits-sections-of-lockbit-ransomware-operation.jpg?w=640&ssl=1\" alt=\"AJ Vicens\"> <\/figure>\n<\/p><\/div>\n<p><h4 class=\"author-card__name\">Written by AJ Vicens<\/h4>\n<p> AJ covers nation-state threats and cybercrime. He was previously a reporter at Mother Jones. Get in touch via Signal\/WhatsApp: (810-206-9411). <\/p>\n<\/p><\/div>\n<div class=\"single-article__tags-container\">\n<h4 class=\"single-article__tags-title\">In This Story<\/h4>\n<\/p><\/div>\n<\/footer>\n<p> <\/html><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"single-article__ads js-single-article-sidebar\">\n<div class=\"ad ad--sidebar js-single-article-sidebar-5 ad--rightrail_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-4 ad--rightrail_2 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-3 ad--rightrail_3 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div><\/div>\n<\/article>\n<div class=\"popular-stories popular-stories--single-post\">\n<div class=\"popular-stories__container\">\n<h2 class=\"popular-stories__title\"> More Scoops <\/h2>\n<p>  <\/div>\n<p>\n<\/div>\n<p> <\/p>\n<section class=\"latest-podcasts\">\n<h2 class=\"latest-podcasts__title\"> Latest Podcasts\t<\/h2>\n<\/section>\n<div class=\"top-categories\">\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Government<\/h3>\n<\/p><\/div>\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Technology<\/h3>\n<\/p><\/div>\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Geopolitics<\/h3>\n<\/p><\/div>\n<\/p><\/div>\n<p> <\/main> <\/p>\n<div class=\"ad ad--bottom \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div id=\"interstitial\" class=\"welcome__container\"> <button id=\"close-modal-1\" class=\"welcome__clickable_area\"><\/button> <\/p>\n<div class=\"welcome__ad_wrapper\">\n<p> <button id=\"close-modal-3\" class=\"welcome__continue-button\">Continue to CyberScoop<\/button> <\/p>\n<\/p><\/div>\n<\/p><\/div>\n<p>   <\/body> <a href=\"https:\/\/cyberscoop.com\/lockbit-arrests-ransomware-fbi-uk-nca-evil-corp\/\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Multinational police effort hits sections of Lockbit ransomware operation |<\/p>\n","protected":false},"author":11,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[282,2145,669,462,1569],"tags":[286,2147,671,463,1570],"class_list":["post-5557","post","type-post","status-publish","format-standard","hentry","category-cybercrime","category-europol","category-federal-bureau-of-investigation-fbi","category-lockbit","category-national-crime-agency","tag-cybercrime","tag-europol","tag-federal-bureau-of-investigation-fbi","tag-lockbit","tag-national-crime-agency"],"featured_image_urls":{"full":"","thumbnail":"","medium":"","medium_large":"","large":"","1536x1536":"","2048x2048":"","chromenews-featured":"","chromenews-large":"","chromenews-medium":""},"author_info":{"display_name":"Cyber Scoop","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/cyberscoop\/"},"category_info":"<a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/cybercrime\/\" rel=\"category tag\">cybercrime<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/europol\/\" rel=\"category tag\">Europol<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/federal-bureau-of-investigation-fbi\/\" rel=\"category tag\">Federal Bureau of Investigation (FBI)<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/lockbit\/\" rel=\"category tag\">LockBit<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/national-crime-agency\/\" rel=\"category tag\">National Crime Agency<\/a>","tag_info":"National Crime Agency","comment_count":"0","jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/5557","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=5557"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/5557\/revisions"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=5557"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=5557"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=5557"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":5557,"date":"2024-10-01T09:33:11","date_gmt":"2024-10-01T14:33:11","guid":{"rendered":"https:\/\/cyberscoop.com\/?p=81989"},"modified":"2024-10-01T09:33:11","modified_gmt":"2024-10-01T14:33:11","slug":"multinational-police-effort-hits-sections-of-lockbit-ransomware-operation","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2024\/10\/01\/multinational-police-effort-hits-sections-of-lockbit-ransomware-operation\/","title":{"rendered":"Multinational police effort hits sections of Lockbit ransomware operation"},"content":{"rendered":"