Police arrested four new individuals linked to the LockBit ransomware operation

An international police operation led to the arrest of four individuals linked to the LockBit ransomware group, including a developer.

Europol, the UK, and the US law enforcement authorities announced a new operation against the LockBit ransomware gang. The police arrested an alleged LockBit developer at France’s request while vacationing outside Russia and two individuals in the UK for supporting a LockBit affiliate. In Spain, the local police arrested the administrator of a bulletproof hosting service, they also seized nine servers belonging to the group’s infrastructure.

“Europol supported a new series of actions against LockBit actors, which involved 12 countries and Eurojust and led to four arrests and seizures of servers critical for LockBit’s infrastructure.” reads the press release published by Europol. “A suspected developer of LockBit was arrested at the request of the French authorities, while the British authorities arrested two individuals for supporting the activity of a LockBit affiliate.”

The arrests and sanctions are part of the third phase of the law enforcement operation code-named Operation Cronos conducted by law enforcement bodies from 12 countries, Europol, and Eurojust. The operation aims at dismantling the LockBit ransomware group. This follows the disruption of LockBit’s infrastructure in February 2024 and further actions against its administrators in May and beyond.

Europol, the UK and the US published press releases on the formed Tor leak site used by the ransomware gang.

Australia, the UK, and the US imposed sanctions on a key LockBit affiliate who is linked to the cybercrime group Evil Corp.

“Aleksandr Ryzhenkov DOB 26/05/1993 has been unmasked by the NCA as the specific member of Evil Corp who is a LockBit affiliate. Ryzhenkov used the affiliate name Beverley, made over 60 LockBit ransomware builds and sought to extort at least $100 million from victims in ransom demands. Ryzhenkov additionally has been linked to the alias mx1r and associated with UNC2165 (an evolution of Evil Corp affiliated actors).” reads the NCA’s announcement.

The UK also sanctioned 15 Russian citizens for ties to Evil Corp, while the US authorities sanctioned six, and Australia sanctioned two.

LockBit gang has been active since 2019, the list of victims is long and includes major organizations such as Bank of America, and the UK Royal Mail. Over the years, law enforcement has arrested multiple individuals involved in the gang’s operation, including Artur Sungatov, Dmitry Khoroshev, and Mikhail Matveev.

Astamirov was arrested in Arizona in June 2023 and charged with deploying LockBit ransomware. Vasiliev, who was extradited to the United States in June, has already been sentenced to four years in federal prison.

Pierluigi Paganini

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

(SecurityAffairs – hacking, Europol)