On 19 February, an international law-enforcement coalition led by the UK's National Crime Agency announced Operation Cronos — the takedown of infrastructure belonging to LockBit, the most prolific ransomware-as-a-service group of the past two years. The NCA replaced LockBit's leak site with a deliberately mocking takedown notice. Decryption keys were recovered and offered to victims. Two affiliates were arrested in Poland and Ukraine. Indictments were filed against named individuals. There was a tone of public victory.

A month later, LockBit is back online, claiming new victims, and the headline takeaway from Cronos is more nuanced than the press conferences suggested. I want to write about what the operation actually achieved, what it did not, and what the realistic expectation should be when defenders next read about a major takedown.

What Cronos actually did

Four substantive things.

Disrupted the criminal infrastructure for several days. LockBit's affiliate panel — the web application through which the dozens of distributed affiliates accessed victim data, generated decryptors, and managed extortion — was offline. The data leak site was replaced. Several affiliates reported being unable to operate during this window.

Recovered decryption keys. Some victims have been able to recover encrypted data without paying. The NCA and FBI continue to make decryptors available where they can.

Exposed information about the group's leadership and operations. The NCA published insight into how LockBit operated, including, in May, the unmasking and sanctioning of Dmitry Khoroshev as LockBitSupp, the group's alleged operator. (Note: that follow-up came after this post — at the time of writing the unmasking was still ahead.)

Damaged the group's brand among the criminal affiliate market. Ransomware-as-a-service is a marketplace. Affiliates choose which platform to work with. A platform that has been infiltrated by law enforcement, that has had its decryption keys recovered, and that has been publicly humiliated, will attract fewer high-end affiliates than a platform that has not.

These are real outcomes. They are not the same thing as ending LockBit.

What Cronos did not do

LockBit was back claiming victims within a week of the takedown. The new infrastructure was less polished but operational. Several of the affiliates who had been working through LockBit have either resumed work through it or moved to other RaaS platforms — Conti's diaspora, ALPHV (which had its own takedown drama and remains a story), Akira, and several smaller ones.

The criminal market is federated. There is no single boss to arrest. There is no single building to raid. The infrastructure is rented, in many cases bulletproof-hosted in jurisdictions that do not co-operate, and rapidly redeployed. The affiliates are not employees. They are independent operators who choose which platform to work through.

This is structurally different from the takedowns of the 2010s, where a single botnet operator could be arrested and the botnet could be sinkholed. Modern RaaS is more like a market than a hierarchy. Disrupting a single seller in the market hurts that seller for a while but does not close the market.

The realistic mental model

The defenders' mental model needs to accommodate this. When the next takedown is announced — and there will be more — the realistic question is not has the criminal group been ended (almost certainly not) but how many weeks does this set them back, how many affiliates does it cost them, and how much information have we learnt about how they operate. Those are real wins. They are not victory.

The operational impact for defenders is more useful than the headline impact. The intelligence developed during a takedown — the tooling, the affiliate IDs, the infrastructure patterns, the indicators — flows into the wider defender ecosystem and improves detection across the board, even against the next group to take the same affiliates on. That is the durable value.

What boards should take from this

Three things.

Do not relax because a group has been taken down. The published guidance on ransomware preparation does not change because LockBit is briefly off the field. The same affiliates will be working through ALPHV, Akira, BlackBasta, and whoever the next platform turns out to be. The defensive posture is platform-independent. The platform changes more often than the posture should.

Read the takedown publications carefully. The NCA, FBI, and Europol publish detailed analyses after operations of this kind. The NCA's published material on LockBit, and the CISA joint advisory, include indicators, tooling, and TTP descriptions that are immediately useful for detection. Most firms do not consume this material systematically. They should.

Expect more takedowns, with diminishing surprise value. The pattern of coordinated multinational takedown, brief criminal disruption, rapid criminal regrouping is now the steady state. It is good policing. It is not the end of ransomware. The end of ransomware, if it comes, will come from a different direction — payment friction, sanction enforcement, victim resilience improvements, jurisdictional cooperation extending to currently uncooperative jurisdictions. None of those is a single event.

A note on the moral dimension

There is a tone in cyber commentary, particularly British cyber commentary, that wants takedowns to be more decisive than they are — that wants the bad guys to be visibly defeated, the public to see justice done, the threat to recede. I share the impulse and I think it is misleading.

Real disruption of criminal markets is gradual. The signal is in the trend, not the event. The number of ransomware incidents in the UK has not yet started to fall. The average ransom demand continues to rise. The proportion of victims who pay is slowly declining, mostly because backup discipline has improved, not because the criminal market has shrunk.

The takedowns are part of a longer programme that, with sustained pressure across years, will produce a shifted equilibrium. Or it will not, and the equilibrium will need a different lever to shift. The honest position now is that we do not yet know which.

What we do know is that the disruption is worth doing, the intelligence yield is real, and the published material is useful. None of which is the same as victory — but quietly, gradually, that is what defenders should be working with.