Police Seized LockBit Gang's Website

Picture the strangest morning in the history of online crime. A criminal wakes up, makes tea, and sits down to start work like any office worker. His office is a hidden website on the dark web, a place ordinary browsers cannot reach. It belongs to LockBit, the most feared ransomware gang on the planet. On that site, the gang proudly displays the names of companies it has robbed, with ticking countdown clocks beside each name. When a clock reaches zero, the stolen private files of that company are thrown onto the open internet for the whole world to read. It is a billboard of shame, and it terrifies boardrooms everywhere.

But on this February morning in 2024, something is wrong. The billboard looks different. The gang’s colours are gone. In their place sits a bright official banner announcing that the site has been seized by law enforcement. The countdown clocks are still there, but now they are counting down to police announcements. The hunters have come home and found the police living in their house, wearing their slippers, and using their own front door to post messages about them. The gang’s partners, logging in one by one, got the same cold shock.

What LockBit is, and how this gang actually worked

LockBit is a gang built around a type of harmful software called ransomware. Ransomware sneaks into a computer network and scrambles the files with strong encryption, which is a kind of digital lock that turns documents, photos and business records into useless gibberish. The only key that can unscramble them belongs to the criminals. They leave a note behind: pay us, usually in cryptocurrency, or your files stay locked forever. For a modern business, locked files can mean no invoices, no customer records, no deliveries and no way to work at all.

The gang first appeared in 2019, and it grew using a business model called ransomware-as-a-service. The core LockBit team built and maintained the locking software, then rented it out to other criminals called affiliates. An affiliate would break into some company, lock its files and collect the ransom. LockBit’s leaders then took a cut of every payment, like a landlord taking rent from every shop in a street. This model let the gang grow frighteningly fast, because hundreds of separate criminals could attack hundreds of separate victims while using the same trusted brand.

Security agencies and security firms repeatedly ranked LockBit as the most active ransomware brand of 2022 and 2023, linking it to a large share of all the ransomware attacks reported around the world. The gang behaved in many ways like a cheeky real software company. It even ran a public bug bounty, offering rewards to anyone who found mistakes in its own criminal software, exactly the way honest technology companies pay people to report flaws. That detail shows something uncomfortable: this was not a teenager in a bedroom. It was an organised business with staff, marketing and quality control, and its product was suffering.

How a LockBit attack reaches an ordinary business

An attack usually begins quietly, long before any files are locked. An affiliate finds a way inside a company’s network. Sometimes that door is a stolen or guessed password. Sometimes it is a computer that has not received its security updates, leaving a known hole wide open. It can also begin with one careless click by one tired employee on one ordinary afternoon. The victim company does not need to be rich or famous. It only needs to be reachable.

Once inside, the criminals explore. They look for the most valuable files and quietly copy them first. This copying matters, because it gives the gang a second weapon. Only after the stealing is done do they set off the ransomware across the whole network at once, often at night or on a weekend when fewer staff are watching. Workers arrive to find every system frozen and a ransom note on every screen.

Then the pressure doubles. The victim is told that paying is not only about unlocking the files. If the company refuses, its stolen private data will be published on LockBit’s leak site, the billboard of shame described above, where customers, rivals and journalists can all read it. So the company is squeezed from two sides at once: its own files are locked, and its secrets are held up like a hostage photograph. That double squeeze is a big reason the model earned so much money for so many years.

The damage LockBit left behind

The victims were not small names. One widely reported case was Royal Mail, the postal service of the United Kingdom, attacked in early 2023. Its international parcel deliveries were badly disrupted for weeks, leaving letters and packages stranded while the company refused to pay and worked to restore its systems. When a service that ordinary families depend on stops working because of a gang hiding behind rented software, the damage stops being a computer problem and becomes a national inconvenience.

Royal Mail was only one entry on a very long list. Hospital groups, schools, city councils, factories, law firms and shops all appeared on that leak site during the gang’s peak years, each with its own ticking clock. Every name on the billboard meant real people who could not get their medicine records, their exam results, their wages or their deliveries. The gang acted untouchable because, for years, it mostly was. Its servers sat hidden, its leaders used nicknames, and its money flowed in a currency designed to be hard to follow. To me, that long run of confidence is the most chilling part of the story, because it shows how safe the criminals felt while standing in plain sight.

Operation Cronos: the morning the police moved in

The confidence ended in February 2024. An international law-enforcement effort named Operation Cronos, led by the United Kingdom’s National Crime Agency together with the FBI, Europol and partner forces in many countries, struck the gang’s hidden machinery. Officers seized LockBit’s servers and websites, including the technology that affiliates used to launch their attacks.

Then the police did something nobody in the criminal world expected. Instead of simply switching the leak site off, they kept it running and redecorated it. The billboard of shame became a police notice board. Officers used the gang’s own pages to publish official announcements, fresh countdown clocks and embarrassing details about the gang itself, with more revelations promised as each clock ran down. Every affiliate and every victim who visited saw the same message: the people who once controlled this address no longer do. In the world of online crime, where reputation is everything, the takeover was designed to humiliate as much as to arrest.

The agencies also announced that they had recovered large numbers of decryption keys, the digital keys that can unlock victims’ files, and that these would be offered free to victims through official channels. For some companies that had refused to pay and were slowly rebuilding from nothing, that news meant their stolen years of records might come back without a single coin going to the gang.

A few months later, in May 2024, American and British authorities publicly named the man they say ran LockBit under the nickname “LockBitSupp”: a Russian national named Dmitry Khoroshev. Both governments sanctioned him, a step that freezes assets and makes it far harder for a person to move money or travel in the open world. The faceless nickname, which had taunted investigators for years, suddenly had a real name and a real photograph attached to it.

The gang did try to crawl back. Within days, a fresh leak site appeared under the LockBit name, hoping to prove the business was alive. But the agencies made a fair point: the brand’s whole value was the promise that its hidden home was safe. Once police had walked through that home, read its files and posed for photographs in its front room, no affiliate could ever fully trust it again.

How to protect yourself from a LockBit-style attack

The first shield is a backup, meaning a spare copy of your important files kept somewhere the ransomware cannot reach. A backup stored on the same network can be locked along with everything else, so keep at least one copy offline, such as on a portable drive that is unplugged after copying, or in a separate protected account. Test the backup sometimes, because a copy you have never tried to restore is only a hope, not a plan.

The second shield is updates. The holes that criminals walk through are usually known holes, and software makers release fixes for them. Turning on automatic updates for your computer, phone, browser and router closes doors before strangers try them. The third shield is care with passwords: use long, different passwords for different accounts, and switch on two-factor sign-in, which asks for a code from your phone as well as your password. A stolen password alone then fails to open the door.

The fourth shield is a pause before clicking. Unexpected attachments, surprise invoices and urgent messages demanding instant action are the classic delivery trucks for ransomware. A thirty-second check, such as calling the sender on a number you already trust, breaks most of these attacks before they begin. And one final lesson matters most of all: never build your safety on the hope that a gang will be caught. Operation Cronos was a famous victory, but it arrived after years of victims had already paid, lost data or closed down. Police work is good news when it comes. It is not a protection plan.

Common questions

What is LockBit in simple words?

LockBit was a criminal gang that rented out file-locking software. Its partners broke into companies, scrambled their files so nothing could be opened, stole copies of private data, and then demanded money to unlock the files and keep the data secret.

What exactly happened during Operation Cronos?

In February 2024, police forces from many countries, led by the UK National Crime Agency with the FBI and Europol, seized the gang’s servers and websites. They then used LockBit’s own leak site to publish police announcements, and offered recovered decryption keys to victims for free.

Did the seizure finish the gang completely?

Not instantly. A new LockBit leak site appeared within days, and the name tried to continue. However, the authorities argued that the gang’s reputation for safety among criminals was destroyed, and in May 2024 the US and UK named and sanctioned the man they say led it, Dmitry Khoroshev.

Can a small business really be a LockBit target?

Yes. The affiliates who rented the software chose victims they could reach, not only famous giants. Any business whose computers hold important files and whose doors are weakly protected could be attacked, which is why backups and updates matter at every size.

Should a victim just pay the ransom?

Police and security agencies generally advise against paying, because payment funds the crime, does not guarantee the files will be unlocked, and the stolen data may still be published. Reporting the attack to the police and getting professional help is the safer first step, and after Operation Cronos some victims could even obtain working keys free through official channels.

Sources

• Wikipedia — LockBit: https://en.wikipedia.org/wiki/LockBit