Seized LockBit site reappears as Operation Cronos teases new arrests
Global law enforcement has apparently once again resurrected the dark web leak site seized by the LockBit ransomware gang, teasing new arrests and information.
LockBit was seized as part of Operation Cronos in February this year, an international operation led by the UK’s National Crime Agency alongside law enforcement agencies from the US, Germany, Canada and Australia.
While LockBit quickly restored operations, it appears that Operation Cronos has new information to share and has reactivated the seized site.
THE @NCA_UK resurrected #LockBitthe domain. More to come. #ransomware pic.twitter.com/e4tjLpXLco
– Brett Callow (@BrettCallow) September 30, 2024
Cyber Daily has observed that the seized LockBit site now contains new posts, all dated yesterday (September 30, 2024), which tease new information about the group.
As with the initial takedown, law enforcement is using the design language and operations of the group’s site and has set countdowns for the release of this information, which includes further arrests.
These include “arrest of major LockBit player”, “LockBit-related arrests in the UK”, “LockBit infrastructure monitored and disrupted”, LockBit missing since February 2024” and “an Evil Corp member identified as affiliated with LockBit.”
Cyber Daily observed several LockBit onion addresses that are still accessible and have recent listings.
The last site entered also has a section saying: “You are using an older version of this site”, and when searching for certain onion addresses, the URL changes and it appears that they are redirecting users to the site entered.
A discussion about the latest Operation Cronos activity has started on BreachForums, with one user claiming it was just a reactivation of the old takedown site.
“Law enforcement has reactivated a seized LockBit onion site to preview some announcements they will be making tomorrow,” the user said.
Operation Cronos also announced the closure of the LockBit site in a week.
Cyber Daily has contacted the Australian Federal Police, involved in Operation Cronos, for comment on the latest activity.
