4 Arrests, Sanctions Follow Global Operation Against Lockbit Group

Europol and multiple countries have taken a significant step against the notorious Lockbit ransomware group with four key arrests and international sanctions. A collaborative effort between France, the UK, and Spain led to the detainment of critical individuals, including a developer and a hosting administrator. The operation is part of a larger international crackdown known as Operation Cronos, which aims to dismantle ransomware networks like Lockbit, known for their extensive global impact between 2021 and 2023.

Global Sanctions Target Lockbit Ransomware Network in Joint Operation

Europol announced on Oct. 1 a major development in the fight against the Lockbit ransomware group, with four arrests and new financial sanctions. France, the UK, and Spain carried out coordinated actions that led to the arrests of key individuals linked to Lockbit, including a developer and a Bulletproof hosting service administrator. Europol detailed:

A suspected developer of Lockbit was arrested at the request of the French authorities, while the British authorities arrested two individuals for supporting the activity of a Lockbit affiliate. The Spanish officers seized nine servers, part of the ransomware’s infrastructure, and arrested an administrator of a Bulletproof hosting service used by the ransomware group.

These actions are part of Operation Cronos, a long-standing international law enforcement effort involving 12 countries and Eurojust. In addition to the arrests, multiple governments imposed sanctions against individuals associated with the ransomware group. Europol noted that Australia, the UK, and the U.S. issued sanctions against a Lockbit affiliate linked to Evil Corp.

Europol added:

The United Kingdom sanctioned fifteen other Russian citizens for their involvement in Evil Corp’s criminal activities, while the United States also sanctioned six citizens and Australia sanctioned two.

Lockbit has been one of the most active ransomware groups globally between 2021 and 2023, operating under a ransomware-as-a-service model. Law enforcement agencies, with Europol’s support, have been working to dismantle Lockbit’s infrastructure since February 2024. Europol also emphasized the role of the “No More Ransom” initiative, which offers free decryption tools for victims and has already assisted over six million individuals worldwide.