NCA Unmasks and Sanctions Leader of Notorious LockBit Ransomware Group

In collaboration with US and Australian authorities, the UK’s National Crime Agency (NCA) has unmasked and sanctioned the leader of the notorious LockBit ransomware group, once considered the world’s most harmful cybercrime operation.

Russian national Dmitry Khoroshev, who went by the online alias “LockBitSupp,” was publicly identified on May 7, 2024, following an extensive international investigation dubbed Operation Cronos.

Khoroshev now faces asset freezes and travel bans from the UK, US, and Australia.

Integrate ANY.RUN in Your Company for Effective Malware Analysis

Are you from SOC, Threat Research, or DFIR departments? If so, you can join an online community of 400,000 independent security researchers:

• Real-time Detection
• Interactive Malware Analysis
• Easy to Learn by New Security Team members
• Get detailed reports with maximum data
• Set Up Virtual Machine in Linux & all Windows OS Versions
• Interact with Malware Safely

If you want to test all these features now with completely free access to the sandbox:

Try ANY.RUN for FREE

The US Department of Justice has also unsealed an indictment against him and is offering a $10 million reward for information leading to his arrest.

LockBit operated as a ransomware-as-a-service (RaaS) model, providing affiliates with tools to conduct ransomware attacks in exchange for a cut of the profits.

The group targeted organizations across critical sectors worldwide, with the US, UK, France, Germany, and China being the top 5 countries hit.

Data obtained by the NCA revealed over 7,000 LockBit attacks were built between June 2022 and February 2024, when the NCA infiltrated the group’s network and took control of its dark web leak site.

The NCA’s disruption of LockBit in February dealt a major blow to the group.

Analysis shows the average number of monthly LockBit attacks has dropped by 73% in the UK since the takedown, with the rebuilding attempt resulting in a “much less sophisticated enterprise with significantly reduced impact.”

The number of active LockBit affiliates has also fallen from 194 pre-February 2024 to just 69.

Khoroshev, despite offering a $10 million bounty for his real identity, was ultimately unable to evade authorities.

“He was certain he could remain anonymous, but he was wrong,” said NCA Director General Graeme Biggar.

The unmasking of LockBitSupp, who thrived on anonymity, sends a powerful message that there is no hiding place for ransomware operators.

The NCA and its international partners are now targeting the LockBit affiliates who conducted devastating attacks against entities like hospitals and schools.

With over 2,500 decryption keys obtained and nearly 240 UK victims proactively contacted, authorities are working to remediate the damage inflicted by the prolific ransomware group.

While the true financial impact of LockBit’s multi-year crime spree is still being uncovered, with multibillion-dollar losses estimated, this landmark operation has undoubtedly struck at the heart of the ransomware ecosystem.

“Today’s announcement puts another huge nail in the LockBit coffin,” Biggar declared.

Is Your Network Under Attack? - Read CISO’s Guide to Avoiding the Next Breach - Download Free Guide