October 1, 2024 at 11:43AM
Law enforcement agencies from 12 countries arrested four suspects connected to the LockBit ransomware gang, including a developer, a hosting service admin, and two others involved in LockBit activity. The joint action led to server seizures and involved Operation Cronos, resulting in additional sanctions and previous arrests of LockBit actors.
The meeting notes highlight the recent joint operation by law enforcement authorities from 12 countries to arrest four suspects associated with the LockBit ransomware gang. The arrests included a developer, a bulletproof hosting service administrator, and two individuals connected to LockBit activity. This coordinated effort also led to the seizure of LockBit infrastructure servers and involved police officers in Operation Cronos, a task force led by the U.K. National Crime Agency (NCA).
Additionally, there were separate arrests in August 2024, including the apprehension of a suspected LockBit ransomware developer at the request of French authorities and the arrest of two individuals in the U.K. linked to LockBit activity, one associated with a LockBit affiliate and the other suspected of money laundering. Furthermore, the administrator of a bulletproof hosting service used to shield LockBit’s infrastructure was arrested at Madrid airport by Spain’s Guardia Civil.
Notably, today, Australia, the United Kingdom, and the United States revealed sanctions against individuals linked to LockBit ransomware, including a prolific LockBit ransomware affiliate linked to Evil Corp. The United Kingdom also sanctioned additional Russian nationals involved in Evil Corp’s criminal activities, while the United States and Australia also imposed sanctions on individuals.
The notes also detail previous arrests of individuals associated with the LockBit ransomware gang, including Mikhail Pavlovich Matveev (aka Wazawaka), Artur Sungatov, Ivan Gennadievich Kondratiev (aka Bassterlord), Dmitry Yuryevich Khoroshev (aka LockBitSupp and putinkrab), Ruslan Magomedovich Astamirov, and Mikhail Vasiliev, who have admitted to participating in ransomware attacks as affiliates of the LockBit ransomware-as-a-service operation.
These insights provide a comprehensive overview of the recent law enforcement actions and sanctions related to the LockBit ransomware gang and its affiliates.