International Law Enforcement on Ransomware: Operation Cronos and LockBit 3.0

Abstract This article probes the effectiveness of international law enforcement operations against major hacking organizations. I adopt a two-step approach. First, I examine 13 multilateral counter-ransomware campaigns conducted between 2014 and 2025. I determine that 85 percent of them achieved their intended aims and led to the termination of group activities. Only two of thirteen groups (15 percent) were able to return to business. However, the high success rate involved structural constraints on operations, which limited their long-term impact, and the overall number of ransomware groups continued to grow during the same period. Second, I conduct a within-case analysis that traced the process of Operation Cronos—a 2024 takedown of LockBit 3.0—one of the most harmful groups to date. My analysis shows mixed results. On the one hand, participating agencies achieved many intended objectives and left damage on the ransomware industry. For a while, the operation helped reduce illicit activity and the sum of ransom paid by victims. On the other hand, LockBit returned to business shortly after the operation and carried out new attacks, although on a lesser scale than before the takedown. Despite the operation, ransomware payments and average amounts of stolen cryptocurrency increased, and many groups and affiliates remain at large. In sum, although the effects of Operation Cronos were considerable, they were limited in temporal terms and in its impact on the cybersecurity landscape.