FBI Assistant Director Brett Leatherman details how Operation Cronos dismantled LockBit, once responsible for 25% of all ransomware attacks. The key strategy was undermining affiliate trust by using LockBit's own leak site to expose affiliates, proving the group couldn't protect their anonymity or deliver on promises. The multinational operation (FBI, UK NCA, Europol, and 10 partners) seized LockBit's entire infrastructure including servers, source code, and decryption keys. Three major lessons emerged: treat reputation as an operational asset, recognize that centralized infrastructure is a double-edged sword for criminal groups, and target the broader ecosystem of affiliates, access brokers, and money launderers rather than just the core group. LockBit attacks in the UK fell 73% post-disruption, with US ransom payments dropping 79% in H2 2024. Leatherman and NCA's Paul Foster will present a full breakdown at Black Hat USA 2026.
