A global cybersecurity leader,  Trend Micro Incorporated has released comprehensive threat intelligence findings in the wake of the law enforcement-led disruption of the LockBit ransomware group.

The unprecedented operation, known as Operation Cronos (in greek mythology, the God of Time), marks a significant step forward in the global fight against cyber threats, impacting an entity responsible for an estimated quarter of all ransomware attacks worldwide.

Most recently, the group claimed responsibility for a data leak affecting South Africa’s Government Employees Pension Fund.

 Operation Cronos was different in several ways from many of the typical law enforcement takedowns of criminal groups. More than a mere setback for threat actors, it was a decisive strike that crippled their infrastructure, undercut their financial mechanisms, exposed affiliates, and fractured the trust within their own illicit networks.

This cumulative effort has helped to tarnish LockBit's reputation among its networks and the cybercrime community in general, making it inept in its attempts to regroup. Ringleader "Lockbitsupp" has also been banned from two popular underground forums: XSS and Exploit.

The group has been trying to rebuild New Onion leak sites launched a week after the operation, and Lockbitsupp is actively seeking brokers selling access to .gov, .edu, and .org TLDs—in what appears to be a reprisal for Cronos. 

However, these efforts appear to be failing. Trend's telemetry reveals limited cases of successful attack since the disruption. Although scores of victims have been posted to the new LockBit leak site, the vast majority were reuploaded from previous campaigns or are victims of other threat groups like ALPHV.

“We are immensely supportive of the excellent disruptive work done by international Law Enforcement against the LockBit group, and our ability to provide support with analysis of the planned upcoming version of their new ransomware,” commented Zaheer Ebrahim, Solutions Architect, Middle East and Africa at Trend Micro.

‘’Getting ahead of these threat actors not only allowed us to pass on intelligence to law enforcement, but also bolstered the defence of our local customer base. As we dissect the aftermath of this takedown, our commitment to enhancing security defence through global threat intelligence is yielding tangible results," he added.

The success of the operation is significant for another reason, as it comes as Lockbit has been developing a new version of ransomware, Lockbit-NG-Dev. Trend Micro affirmed that it has been monitoring this closely and provided advanced protections to its customers.

In short, the key achievements of Operation Cronos include: 

• Reputational Damage to LockBit: Given its tarnished reputation, LockBit faces significant challenges in rebuilding its operations and affiliate networks.
• Strategic Disruption of Infrastructure: The operation's in-depth approach has made LockBit's rebuilding and regrouping process difficult and time-consuming, delaying any potential resurgence.
• Effective Deterrence: The insight into affiliate activities and the subsequent warnings have likely dismantled any of LockBit's affiliate programs, further weakening its operational capacity.
• Enhanced Business Security: Trend customers stand to benefit from the operation's outcome and a reduced risk of being targeted by a significant player in the ransomware market.

Trend Micro stressed that this disruption of LockBit underscores its ‘’relentless pursuit of anticipating threats and shielding organisations worldwide from the evolving dangers of the cyber landscape.’’ It also demonstrates that the best way to disrupt common adversaries is by sharing intelligence promptly and efficiently.

Finally, the victory shouldn’t be forgotten or glossed over, particularly as cybercrime is on the rise, but cybercrime syndicates and groups are not as infallible, apparently, as they may have thought.