Operation Cronos: Infiltrating the LockBit Ransomware Syndicate

Ever wonder what goes into taking down the world’s biggest ransomware group. Well in this episode   Ian Andrews (CMO, Chainalysis) speaks to  Phil Larratt (Director of Investigations, Chainalysis) and William Lyne (Head of Cyber Intelligence, National Crime Agency (NCA)), who share how UK law enforcement along with their International partners were able to infiltrate and eventually shutdown the most prolific ransomware ecosystem, LockBit.

The trio discuss LockBit, the major ransomware-as-a-service threat and provide a detailed account of Operation Cronos, a sophisticated takedown that compromised LockBit’s system and eventually led to the takedown of their operations

Phil and William explain the intricacies of crypto tracing, International law enforcement collaboration, and the innovative tactics used to protect victims and hinder cybercrimes, like ransomware.

This is one of the few episodes that provides a riveting inside look at one of the most significant crypto ransomware operations to date and the ripple effects on the larger cybercrime ecosystem.

Minute-by-minute episode breakdown

2 | William Lyne’s background going from Astro-Physics into Cyber Crime at NCA

4 | Introduction to Phil Larratt and unpacking a 100 Million Pound “Vishing” fraud case 

8 | The scale of the LockBit Ransomware syndicate and affiliates

14 | Operation Cronos and how law enforcement infiltrated an entire ransomware ecosystem 

18 | Blockchain intelligence’s role in fighting cyber crimes like ransomware

23 | Government’s covert operations against ransomware hackers

27 | The impact on the ransomware ecosystem post-LockBit takedown 

30 | New UK Law enhances crypto asset seizure capabilities to fight cyber crime 

Related resources

Check out more resources provided by Chainalysis that perfectly complement this episode of the Public Key.

• Website: National Crime Agency (NCA): The deployment of ransomware remains the greatest cyber serious and organised crime threat to the UK
• News: Operation Cronos: International investigation disrupts the world’s most harmful cyber crime group
• Project: RUSI:  Ransomware Harms and the Victim Experience
• Blog: U.S. and U.K. Disrupt Lockbit Ransomware Group and Indict Two Russian Nationals While OFAC Levies Sanctions
• Announcement: Announcing Chainalysis’ 2024 U.S. Public Sector Customer Awards Program
• Report: Chainalysis Money Laundering and Cryptocurrency Report (Available Now)
• Report: [REPORT PREVIEW] Malign Interference and Crypto: How Crypto Transaction Tracing Can Expose and Disrupt Malign Influence Efforts
• YouTube: Chainalysis YouTube page
• Twitter: Chainalysis Twitter: Building trust in blockchain
• Tik Tok: Building trust in #blockchains among people, businesses, and governments.
• Telegram: Chainalysis on Telegram 

Speakers on today’s episode

• Ian Andrews * Host * (Chief Marketing Officer, Chainalysis) 
• William Lyne (Head of Cyber Intelligence, National Crime Agency (NCA))
• Phil Larratt (Director of Investigations, Chainalysis) 

This website may contain links to third-party sites that are not under the control of Chainalysis, Inc. or its affiliates (collectively “Chainalysis”). Access to such information does not imply association with, endorsement of, approval of, or recommendation by Chainalysis of the site or its operators, and Chainalysis is not responsible for the products, services, or other content hosted therein.

Our podcasts are for informational purposes only, and are not intended to provide legal, tax, financial, or investment advice. Listeners should consult their own advisors before making these types of decisions. Chainalysis has no responsibility or liability for any decision made or any other acts or omissions in connection with your use of this material.

Chainalysis does not guarantee or warrant the accuracy, completeness, timeliness, suitability or validity of the information in any particular podcast and will not be responsible for any claim attributable to errors, omissions, or other inaccuracies of any part of such material. 

Unless stated otherwise, reference to any specific product or entity does not constitute an endorsement or recommendation by Chainalysis. The views expressed by guests are their own and their appearance on the program does not imply an endorsement of them or any entity they represent. Views and opinions expressed by Chainalysis employees are those of the employees and do not necessarily reflect the views of the company.