NCA unmasks LockBitSupp cyber gangster who toyed with pursuers

Operation Cronos

The operation against the notorious LockBit ransomware gang, Operation Cronos, unfolded on 19 February 2024 in an NCA-led operation that saw the agency infiltrate its network and take over its services, including its dark web leak site.

The NCA today said that the ransomware-as-a-service operation conducted over 7,000 cyber attacks between June 2022 and February 2025, with victims including over 100 hospitals and healthcare organisations, and at least 2,110 victims being forced into some degree of negotiation.

Out of 194 affiliates identified as using LockBit’s services up until February 2024, this has now fallen to 69 as the group struggles to rebuild. Of those active affiliates, 148 conducted attacks and 119 engaged in negotiations with victims, although up to 114 affiliates, who would have paid thousands to join LockBit’s programme, never actually made any money from their criminality.

It also added that it had found multiple instances where the decryptor supplied by LockBit to victims that did pay never worked, and many others where LockBit failed to keep its “promise” to delete stolen data once paid.

The NCA said it was now in possession of over 2,500 decryption keys and was continuing to contact LockBit’s victims to offer support. It has so far identified and contacted 240 victims in the UK.

LockBit’s rebuild not going well

Meanwhile, the group’s attempt to rebuild over the past couple of months appears to be going badly, with the gang still running at limited capacity, and its new leak site being used to publicise victims attacked before the takedown, as well as trying to take credit for the crimes of others.

The NCA’s latest data suggests that the number of monthly LockBit attacks in the UK has dropped by 73% since late February, and those attacks that are occurring are being carried out by less sophisticated actors with much less impact.

“Since Operation Cronos took disruptive action, LockBit has been battling to reassert its dominance and, most importantly, its credibility within the cyber criminal community,” said Don Smith, vice-president of SecureWorks’ Counter Threat Unit.

“The psychological element of the action taken by law enforcement was extremely effective, the group’s efforts to re-establish its previous reputation have not gone particularly well. Today’s unmasking of Dmitry Khoroshev aka LockBit Supp, demonstrates the ability of law enforcement to deny cyber criminals the safety blanket of anonymity and place them at risk of arrest and prosecution if they travel out with their home country.”