LockBit

More than 11,000 LockBit domains were seized in a February 2024 multinational crackdown, yet later victim fallout and developer cases kept the ransomware operation in view.

Who they are

LockBit is a Russia-linked ransomware operation that featured in coverage as a ransomware-as-a-service group targeting major businesses and institutions, including Royal Mail, Boeing, ICBC and Evolve Bank & Trust. Stories track both its alleged extortion activity and the network of affiliates, developers and infrastructure that enabled it.

The recent arc

Coverage peaked in 2024Q1 as an 11-country law-enforcement operation involving the FBI and UK National Crime Agency disrupted LockBit, seized 11,000 domains, arrested two operators in Poland and Ukraine, issued warrants and made decryption resources available. The crackdown was followed in May by UK and US identification, charges and sanctions targeting the group’s alleged leader, turning the story from high-profile attacks, such as the 2023 Boeing and ICBC incidents, toward attribution and enforcement. പിന്നീട്

The tension

The coverage repeatedly tests whether disruption equals defeat. Experts described the February 2024 action against LockBit as a major blow while cautioning that ransomware groups can regroup; subsequent reporting supports the persistence of both harm and supporting infrastructure, from the Evolve Bank breach affecting at least 7.6 million people to sanctions on hosting provider Zservers and the extradition case against alleged developer Rostislav Panev. LockBit’s ransomware-as-a-service model, also associated in coverage with BlackCat, is central to that resilience problem.

Why it matters

LockBit’s arc shows that dismantling ransomware requires more than taking down public-facing domains or pursuing a presumed leader: victim recovery, affiliate networks, developers and hosting providers remain consequential. If the enforcement cases and infrastructure actions continue to expose those layers, they could constrain the model that made LockBit effective; the 2025 compromise of its affiliate panels also suggests that operational visibility can become a pressure point, though the corpus does not establish whether that will permanently weaken the group.

Related: FBI · Rostislav Panev · Royal Mail · Boeing · Law enforcement agencies from 11 countries, including the FBI and UK N · Wise, Affirm, Mercury, and other companies say they're investigating h