Push Admin

A handout picture released by Britain's National Crime Agency (NCA) in London on February 20, 2024 shows a screen shot of the seized cyber crime group 'LockBit' site. National Crime Agency via AFP.

Article (news)

Agence France-Presse

<div dir="ltr" style="line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:10pt"><span class="fr-img-caption fr-fic fr-dib" style="width:950px"><span class="fr-img-wrap"><img src="https://od2-image-api.abs-cbn.com/prod/editorImage/022124_LockBit.jpg" style="width:950px" class="fr-fic fr-dib"/><span class="fr-inner" style="text-align:left">A handout picture released by Britain&#x27;s National Crime Agency (NCA) in London on February 20, 2024 shows a screen shot of the seized cyber crime group &#x27;LockBit&#x27; site. <em><strong>National Crime Agency via AFP.</strong></em></span></span></span></div><div dir="ltr" style="line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:10pt"><span style="color:#000000;background-color:transparent;text-decoration:none;vertical-align:baseline;white-space:pre-wrap">LONDON -- An international operation led by UK and US law enforcement has severely disrupted &quot;the world&#x27;s most harmful cybercrime group&quot;, the Russian-linked ransomware specialist LockBit, officials announced Tuesday.</span></div><div dir="ltr" style="line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:10pt"><span style="color:#000000;background-color:transparent;text-decoration:none;vertical-align:baseline;white-space:pre-wrap">LockBit and its affiliates have targeted governments, major companies, schools and hospitals, causing billions of dollars of damage and extracting tens of millions in ransoms from victims.</span></div><div dir="ltr" style="line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:10pt"><span style="color:#000000;background-color:transparent;text-decoration:none;vertical-align:baseline;white-space:pre-wrap">Britain&#x27;s National Crime Agency (NCA), working with the Federal Bureau of Investigation, Europol and agencies from nine other countries in Operation Cronos, said it had infiltrated LockBit&#x27;s network and taken control of its services.</span></div><div dir="ltr" style="line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:10pt"><span style="color:#000000;background-color:transparent;text-decoration:none;vertical-align:baseline;white-space:pre-wrap">&quot;We have hacked the hackers, we have taken control of their infrastructure, seized their source code, and obtained keys that will help victims decrypt their systems,&quot; NCA director general Graeme Biggar told reporters in London.</span></div><div dir="ltr" style="line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:10pt"><span style="color:#000000;background-color:transparent;text-decoration:none;vertical-align:baseline;white-space:pre-wrap">LockBit&#x27;s website -- selling services that allow people to organize cyber attacks and hold data until a ransom is paid appears -- was taken over on Monday evening.</span></div><div dir="ltr" style="line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:10pt"><span style="color:#000000;background-color:transparent;text-decoration:none;vertical-align:baseline;white-space:pre-wrap">A message appeared on the site stating that it was &quot;now under control of law enforcement&quot;.</span></div><div dir="ltr" style="line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:10pt"><span style="color:#000000;background-color:transparent;text-decoration:none;vertical-align:baseline;white-space:pre-wrap">&quot;As of today LockBit is effectively redundant, LockBit has been locked out,&quot; Biggar said.</span></div><div dir="ltr" style="line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:10pt"><span style="color:#000000;background-color:transparent;text-decoration:none;vertical-align:baseline;white-space:pre-wrap">The US Justice Department (DOJ) said the agencies had seized control of &quot;numerous public-facing websites used by LockBit to connect to the organization&#x27;s infrastructure&quot; and taken control of servers used by LockBit administrators.</span></div><div dir="ltr" style="line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:10pt"><span style="color:#000000;background-color:transparent;text-decoration:none;vertical-align:baseline;white-space:pre-wrap">The NCA added that it had obtained more than 1,000 decryption keys and will be contacting UK-based victims in the coming days and weeks to offer support and help them recover encrypted data.</span></div><div dir="ltr" style="line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:10pt"><span style="color:#000000;background-color:transparent;text-decoration:none;vertical-align:baseline;white-space:pre-wrap">Biggar said the network had been behind 25 percent of all cyber attacks in the past year.</span></div><div dir="ltr" style="line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:10pt"><span style="color:#000000;background-color:transparent;text-decoration:none;vertical-align:baseline;white-space:pre-wrap">LockBit has targeted over 2,000 victims and received more than $120 million in ransom payments since it formed four years ago, according to the DOJ.</span></div><div dir="ltr" style="line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:10pt"><span style="color:#000000;background-color:transparent;text-decoration:none;vertical-align:baseline;white-space:pre-wrap">Those targeted have included Britain&#x27;s Royal Mail, US aircraft manufacturer Boeing, and a Canadian children&#x27;s hospital.</span></div><div dir="ltr" style="line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:10pt"><span style="color:#000000;background-color:transparent;text-decoration:none;vertical-align:baseline;white-space:pre-wrap">In January 2023, US law enforcers shut down the Hive ransomware operation which extorted some $100 million from more than 1,500 victims worldwide.</span></div><div dir="ltr" style="line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:10pt"><span style="color:#000000;background-color:transparent;text-decoration:none;vertical-align:baseline;white-space:pre-wrap">Since then, LockBit has been seen as the biggest current threat.</span></div><div dir="ltr" style="line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:10pt"><a href="https://news.abs-cbn.com/news/2024/2/1/what-we-know-about-china-s-alleged-state-backed-hacking-1822"></a><span style="color:#000000;background-color:transparent;text-decoration:none;vertical-align:baseline;white-space:pre-wrap"><a class="fr-green fr-strong" href="https://news.abs-cbn.com/news/2024/2/1/what-we-know-about-china-s-alleged-state-backed-hacking-1822">READ: What we know about China&#x27;s alleged state-backed hacking</a></span></div><div dir="ltr" style="line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:10pt"><a href="https://news.abs-cbn.com/spotlight/05/25/21/cyberattacks-bigger-smarter-us-pipeline"></a><span style="color:#000000;background-color:transparent;text-decoration:none;vertical-align:baseline;white-space:pre-wrap"><a class="fr-green fr-strong" href="https://news.abs-cbn.com/spotlight/05/25/21/cyberattacks-bigger-smarter-us-pipeline">READ: Cyberattacks: Bigger, smarter, faster</a></span></div><div dir="ltr" style="line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:10pt"><a href="https://news.abs-cbn.com/news/2024/2/20/1-in-3-pinoys-face-threats-from-usbs-other-removable-devices-report-1344"></a><span style="color:#000000;background-color:transparent;text-decoration:none;vertical-align:baseline;white-space:pre-wrap"><a class="fr-green fr-strong" href="https://news.abs-cbn.com/news/2024/2/20/1-in-3-pinoys-face-threats-from-usbs-other-removable-devices-report-1344">READ: 1 in 3 Pinoys face threats from USBs, other removable devices</a></span></div><div dir="ltr" style="line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:10pt"><span style="color:#000000;background-color:transparent;text-decoration:none;vertical-align:baseline;white-space:pre-wrap"><strong>- Dark Web -</strong></span></div><div dir="ltr" style="line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:10pt"><span style="color:#000000;background-color:transparent;text-decoration:none;vertical-align:baseline;white-space:pre-wrap">Hive and LockBit are part of what cybersecurity experts call a &quot;ransomware as a service&quot; style, or RaaS -- a business that leases its software and methods to others to use in extorting money.</span></div><div dir="ltr" style="line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:10pt"><span style="color:#000000;background-color:transparent;text-decoration:none;vertical-align:baseline;white-space:pre-wrap">Ariel Ropek, director of cyber threat intelligence at cybersecurity firm Avertium, told AFP last year that this structure makes it possible for criminals with minimal computer fluency to get into ransomware by paying others for their expertise.</span></div><div dir="ltr" style="line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:10pt"><span style="color:#000000;background-color:transparent;text-decoration:none;vertical-align:baseline;white-space:pre-wrap">On the so-called dark web, providers of ransomware services pitch their products openly.</span></div><div dir="ltr" style="line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:10pt"><span style="color:#000000;background-color:transparent;text-decoration:none;vertical-align:baseline;white-space:pre-wrap">At one end are the initial access brokers, who specialize in breaking into corporate or institutional computer systems.</span></div><div dir="ltr" style="line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:10pt"><span style="color:#000000;background-color:transparent;text-decoration:none;vertical-align:baseline;white-space:pre-wrap">They then sell that access to the hacker, or ransomware operator.</span></div><div dir="ltr" style="line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:10pt"><span style="color:#000000;background-color:transparent;text-decoration:none;vertical-align:baseline;white-space:pre-wrap">But the operator depends on RaaS developers like Hive or LockBit, which have the programming skills to create the malware needed to carry out the operation.</span></div><div dir="ltr" style="line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:10pt"><span style="color:#000000;background-color:transparent;text-decoration:none;vertical-align:baseline;white-space:pre-wrap">Typically, their programs -- once inserted by the ransomware operator into a target&#x27;s IT systems -- are manipulated to freeze, via encryption, the target&#x27;s files and data.</span></div><div dir="ltr" style="line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:10pt"><span style="color:#000000;background-color:transparent;text-decoration:none;vertical-align:baseline;white-space:pre-wrap">RaaS developers offer a full service to the operators, for a large share of the ransom paid out, said Ropek.</span></div><div dir="ltr" style="line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:10pt"><span style="color:#000000;background-color:transparent;text-decoration:none;vertical-align:baseline;white-space:pre-wrap">When the ransomware is planted and activated, the target receives a message telling them how much to pay to get their data unencrypted.</span></div><div dir="ltr" style="line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:10pt"><span style="color:#000000;background-color:transparent;text-decoration:none;vertical-align:baseline;white-space:pre-wrap">That ransom can run from thousands to millions of dollars.</span></div><div dir="ltr" style="line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:10pt"><span style="color:#000000;background-color:transparent;text-decoration:none;vertical-align:baseline;white-space:pre-wrap">On Tuesday, the US unsealed an indictment against two Russian nationals, bringing to five the number of Russians it has charged in connection with LockBit.</span></div><div dir="ltr" style="line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:10pt"><span style="color:#000000;background-color:transparent;text-decoration:none;vertical-align:baseline;white-space:pre-wrap">In a separate notice, the US Treasury Department said it is imposing sanctions on the pair, affiliates of LockBit, who &quot;actively engaged&quot; in ransomware attacks.</span></div><div dir="ltr" style="line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:10pt"><span style="color:#000000;background-color:transparent;text-decoration:none;vertical-align:baseline;white-space:pre-wrap">Biggar said a &quot;large concentration&quot; of the cyber criminals are in Russia and are Russian-speaking, but law enforcement agencies have not seen any direct support for LockBit from the Russian state.</span></div><div dir="ltr" style="line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:10pt"><span style="color:#000000;background-color:transparent;text-decoration:none;vertical-align:baseline;white-space:pre-wrap">&quot;There is clearly some tolerance of cyber criminality within Russia,&quot; he added.</span></div><div dir="ltr" style="line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:10pt"><span style="color:#000000;background-color:transparent;text-decoration:none;vertical-align:baseline;white-space:pre-wrap">© Agence France-Presse</span></div><div dir="ltr" style="line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:10pt"><a href="https://news.abs-cbn.com/spotlight/04/13/23/us-intelligence-leak-what-we-know-so-far"></a><span style="color:#000000;background-color:transparent;text-decoration:none;vertical-align:baseline;white-space:pre-wrap"><a class="fr-green fr-strong" href="https://news.abs-cbn.com/spotlight/04/13/23/us-intelligence-leak-what-we-know-so-far">READ: US intelligence leak: What we know so far</a></span></div><div dir="ltr" style="line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:10pt"><a href="https://news.abs-cbn.com/overseas/01/27/21/police-dismantle-worlds-most-dangerous-criminal-hacking-network"></a><span style="color:#000000;background-color:transparent;text-decoration:none;vertical-align:baseline;white-space:pre-wrap"><a class="fr-green fr-strong" href="https://news.abs-cbn.com/overseas/01/27/21/police-dismantle-worlds-most-dangerous-criminal-hacking-network">READ: Police dismantle world&#x27;s &#x27;most dangerous&#x27; criminal hacking network</a></span></div><div dir="ltr" style="line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:10pt"><br/></div><div dir="ltr" style="line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:10pt"><span style="color:#000000;background-color:transparent;text-decoration:none;vertical-align:baseline;white-space:pre-wrap"><strong>RELATED VIDEO:</strong></span></div><div dir="ltr" style="line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:10pt"><span class="fr-video fr-deletable fr-fvc fr-dvb fr-draggable" contenteditable="false" draggable="true"><iframe width="640" height="360" src="https://www.youtube.com/embed/9soduj88zYM?&amp;wmode=opaque&amp;rel=0" frameBorder="0" allowfullscreen="" class="fr-draggable"></iframe></span><br/></div><div><br/></div><div><br/></div>

<p>An international operation led by UK and US law enforcement has severely disrupted "the world's most harmful cybercrime group", the Russian-linked ransomware specialist LockBit.</p>

An international operation led by UK and US law enforcement has severely disrupted "the world's most harmful cybercrime group", the Russian-linked ransomware specialist LockBit.

Global operation smashes 'most harmful cyber crime group'

News

Entertainment

Lifestyle

Sports

Metro.Style

More

Traffic

Manila

Horoscope

News

Global operation smashes 'most harmful cyber crime group'

Agence France-Presse,

Helen Rowe

Published Feb 21, 2024 12:45 AM PHT

Read More:

LockBit

cybercrime

National Crime Agency

FBI

Europol

Operation Cronos

Federal Bureau of Investigation

hacking

ransomware

ABS-CBN is the leading media and entertainment company in the Philippines, offering quality content across TV, radio, digital, and film. Committed to public service and promoting Filipino values, ABS-CBN continues to inspire and connect audiences worldwide.

Corporate

Investors

Governance

International Distribution

Corporate

Governance

Investors

International Distribution

NPC Seal of Registration

Privacy Policy

AI Policy

Terms of Service

Advertise with Us

© 2026 ABS-CBN Corporation. All Rights Reserved.

NPC Seal of Registration

Privacy Policy

Terms of Service

AI Policy

Advertise with Us

© 2026 ABS-CBN Corporation. All Rights Reserved.

NPC Seal of Registration

Privacy Policy

Terms of Service

AI Policy

Advertise with Us

© 2026 ABS-CBN Corporation. All Rights Reserved.