Experts say the weakening of LockBit and BlackCat marks a significant milestone in efforts to thwart cybercriminals, but ransomware hackers are not going away
- LockBit and BlackCat thrived using ransomware as service model — Law enforcement seized websites belong to both hacking groups
Context & Ripple Effects
The coordinated action against LockBit followed an 11-country operation that seized thousands of LockBit domains, while prior coverage had tied the group’s ransomware-as-a-service model to a major attack on ICBC. The parallel weakening of BlackCat matters because it tests whether disrupting the infrastructure of major criminal platforms can impair the broader affiliate ecosystem, not merely one brand.
First-order effects
- LockBit and BlackCat lose web infrastructure used to run and publicize their operations, disrupting access for operators, affiliates and victims dealing with active incidents.
- Law-enforcement agencies gain a visible operational success against two prominent ransomware-as-a-service groups, though the article’s experts caution that the underlying attackers remain active.
Second-order effects
- Affiliates and other ransomware operators may need to shift tools, infrastructure or partnerships after the two platforms’ disruption, raising friction for campaigns in the near term.
- Victims and security teams face a less predictable threat environment: takedowns can interrupt established groups, but they can also scatter operators across smaller services and new identities.
Third-order effects
- If repeated cross-border seizures remain effective, ransomware-as-a-service platforms could become less durable as centralized brands and infrastructure become easier enforcement targets.
- The longer contest shifts toward access and infrastructure control: disruption can constrain criminal operations, but lasting reduction depends on whether affiliates can be prevented from reconstituting elsewhere.
The trend: Ransomware enforcement is moving from chasing individual incidents toward disrupting the infrastructure and platform economics that let criminal affiliates operate at scale.