IC Technology & Cyber — 2026-07-30

FBI Cyber Division Reveals How Breaking Affiliate Trust Drove Permanent Degradation of LockBit Ransomware Empire

BLUFOperation Cronos validated reputation denial as replicable doctrine against RaaS networks, but Khoroshev faces almost no chance of arrest by year-end 2026 while Russia provides sanctuary.

According to Dark Reading, FBI Cyber Division assistant director Brett Leatherman said the February 2024 multinational takedown of LockBit, Operation Cronos, succeeded largely by breaking affiliate trust rather than merely seizing infrastructure 1. LockBit operated from 2020 to 2024, victimizing more than 2,500 organizations across at least 120 countries including over 1,800 in the US, and extorted more than $500 million in ransom payments through a network of nearly 200 affiliates 1. The FBI, the UK's National Crime Agency, Europol and ten other partners seized LockBit's leak site, control panel, source code and servers, then published affiliate names on the group's own site with countdown clocks 1. NCA deputy director Paul Foster said the operation's success required close inter-agency cooperation 1. Leatherman cited Chainalysis figures showing LockBit's UK attacks fell 73% and US ransom payments fell 79% in the second half of 2024, while leader Dmitry Khoroshev remains at large under a $10 million DOJ reward 1.

Analysis
The disclosure confirms reputation denial, not infrastructure seizure alone, as deliberate law enforcement doctrine against ransomware-as-a-service networks, a template FBI officials frame as reusable against successor groups. Khoroshev's continued liberty despite a $10 million DOJ reward shows technical and reputational disruption alone do not compel arrest. There is almost no chance Khoroshev will be taken into law enforcement custody by year-end 2026, reflecting Russian non-extradition practice that shields him from FBI reach. This judgment carries low confidence, reflecting the absence of any observable indicator of movement toward his location or apprehension. Ransomware operators are already decentralizing infrastructure in direct response to the Cronos playbook, complicating replication of this model against dispersed successor networks.

2 sources

FBI: Breaking Affiliate Trust Sped Along LockBit Takedown - Dark Reading
Operation Cronos dismantled LockBit ransomware group by undermining affiliate trust - SC Media