--- title: FBI: Breaking Affiliate Trust Sped Along LockBit's Takedown description: FBI Assistant Director Brett Leatherman details how Operation Cronos dismantled LockBit, once responsible for 25% of all ransomware attacks. The key strategy... canonical: https://daily.dev/posts/fbi-breaking-affiliate-trust-sped-along-lockbit-s-takedown-pd75zct68 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: FBI: Breaking Affiliate Trust Sped Along LockBit's Takedown | daily.dev og:description: FBI Assistant Director Brett Leatherman details how Operation Cronos dismantled LockBit, once responsible for 25% of all ransomware attacks. The key strategy... og:url: https://daily.dev/posts/fbi-breaking-affiliate-trust-sped-along-lockbit-s-takedown-pd75zct68 og:image: https://api.daily.dev/og/posts/Pd75ZCt68.png og:image:alt: FBI: Breaking Affiliate Trust Sped Along LockBit's Takedown og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # FBI: Breaking Affiliate Trust Sped Along LockBit's Takedown **[Dark Reading](https://daily.dev/sources/dr)** · 7 min read · 0 upvotes · 0 comments ## Summary FBI Assistant Director Brett Leatherman details how Operation Cronos dismantled LockBit, once responsible for 25% of all ransomware attacks. The key strategy was undermining affiliate trust by using LockBit's own leak site to expose affiliates, proving the group couldn't protect their anonymity or deliver on promises. The multinational operation (FBI, UK NCA, Europol, and 10 partners) seized LockBit's entire infrastructure including servers, source code, and decryption keys. Three major lessons emerged: treat reputation as an operational asset, recognize that centralized infrastructure is a double-edged sword for criminal groups, and target the broader ecosystem of affiliates, access brokers, and money launderers rather than just the core group. LockBit attacks in the UK fell 73% post-disruption, with US ransom payments dropping 79% in H2 2024. Leatherman and NCA's Paul Foster will present a full breakdown at Black Hat USA 2026. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: --- Tags: [#ransomware](https://daily.dev/tags/ransomware), [#lockbit](https://daily.dev/tags/lockbit) [View this post on daily.dev](https://daily.dev/posts/fbi-breaking-affiliate-trust-sped-along-lockbit-s-takedown-pd75zct68) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"FBI: Breaking Affiliate Trust Sped Along LockBit's Takedown","url":"https://daily.dev/posts/fbi-breaking-affiliate-trust-sped-along-lockbit-s-takedown-pd75zct68","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/fbi-breaking-affiliate-trust-sped-along-lockbit-s-takedown-pd75zct68"},"datePublished":"2026-07-27T20:57:45.192Z","dateModified":"2026-07-27T20:58:10.376Z","description":"FBI Assistant Director Brett Leatherman details how Operation Cronos dismantled LockBit, once responsible for 25% of all ransomware attacks. The key strategy...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/17fe3338e320bfc7fb1e1483c8f09c02?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/17fe3338e320bfc7fb1e1483c8f09c02?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Dark Reading","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Dark Reading","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/dr","url":"https://daily.dev/sources/dr"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/fbi-breaking-affiliate-trust-sped-along-lockbit-s-takedown-pd75zct68","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"ransomware,lockbit","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Dark Reading","item":"https://daily.dev/sources/dr"},{"@type":"ListItem","position":3,"name":"FBI: Breaking Affiliate Trust Sped Along LockBit's Takedown"}]} ```