In February 2024, a coordinated law enforcement operation — Operation Cronos — dismantled the infrastructure underpinning LockBit 3.0, at that point the most prolific ransomware-as-a-service platform operating globally. Servers were seized. Source code and internal affiliate data were obtained. Decryption keys were recovered and made available to victims through the No More Ransom initiative. In May 2024, authorities identified and sanctioned Dmitry Khoroshev, a Russian national operating as LockBitSupp, as the administrator behind the LockBit brand.
By most visible measures, the operation succeeded. Within days, LockBit's operators were claiming a return to service on backup infrastructure. More significantly, the affiliates who had actually conducted LockBit attacks — independent contractors operating under the ransomware-as-a-service model — did not stop working. They found new platforms.
What Operation Cronos actually disrupted
The February 2024 action, led by the UK's National Crime Agency with participation from the FBI, Europol, and law enforcement partners across ten countries, achieved concrete outcomes. Investigators seized LockBit's public-facing websites, obtained the group's tooling and affiliate records, and recovered over one thousand decryption keys that were distributed to victims. Criminal charges and financial sanctions followed.
These were meaningful achievements. They also illustrated the structural resilience of the ransomware-as-a-service model. LockBit was not a tightly controlled criminal organization. It was a platform — a brand, a toolset, and a negotiation infrastructure — licensed to independent affiliates who conducted their own attacks, retained the majority of ransom revenue, and carried no obligation to stop operating when the platform itself was disrupted.
Where the affiliates went
The RaaS ecosystem does not tolerate vacancy. As Operation Cronos was unwinding LockBit's operations, a competing platform called RansomHub was rapidly expanding its affiliate base. Security researchers tracked behavioral and technical patterns consistent with experienced LockBit operators — and former BlackCat/ALPHV affiliates — migrating to RansomHub, which distinguished itself by offering affiliates a higher revenue share than most competing platforms.
BlackCat/ALPHV is worth noting separately. The FBI had disrupted that operation in December 2023. By March 2024, BlackCat's administrators appeared to have exit-scammed following a high-profile attack, abruptly withdrawing ransom proceeds and abandoning their own affiliates. That event released another cohort of experienced, displaced operators into the broader market.
Other established groups — Akira, Play, and Black Basta among them — remained active throughout this period and represent credible destinations for affiliates seeking continuity. LockBit has claimed development of a successor version, though any operational status should be treated with skepticism until corroborated by independent security research.
The pattern is not new. When major ransomware operations are disrupted, the talent redistributes. Criminal infrastructure adapts faster than enterprise security programs typically do.
Why mid-market regulated businesses remain the preferred target
Law firms, healthcare practices, financial advisory groups, and professional services firms share a profile that makes them attractive to ransomware affiliates operating on any platform:
- High-value data under regulatory obligation. Protected health information, privileged legal communications, and client financial records create immediate leverage. A mandatory breach notification deadline is itself a clock affiliates can use against you.
- Technical debt at scale. Mid-market organizations in regulated sectors have grown rapidly through the same period that ransomware activity peaked. Many carry unpatched systems, legacy VPN appliances, and inconsistent endpoint coverage that larger enterprises have had more resources to address.
- Double extortion economics. Encrypting files and threatening to publish sensitive client data simultaneously is standard operating procedure across RaaS platforms. For organizations whose business depends on client confidentiality, the publication threat often carries more weight than the encryption itself.
What changed tactically after the takedown
Post-takedown periods produce observable shifts in attacker behavior. Affiliates migrating to new platforms often need to establish credibility quickly, which can compress attack timelines and reduce negotiation patience. New platforms competing aggressively for affiliate talent may temporarily lower their recruitment standards, meaning less experienced actors gain access to capable tooling and infrastructure.
There is also a detection gap that benefits attackers. When a dominant platform is disrupted, security tooling tuned to that group's specific indicators of compromise may not recognize the same operators working under a different brand. Behavioral detections are more durable than signature-based detections in this environment, but many mid-market organizations rely heavily on the latter.
Initial access methods have not meaningfully changed across this disruption. Affiliates continue to exploit unpatched VPN and remote access vulnerabilities, purchase credentials from initial access brokers, and deploy targeted phishing against organizations' externally exposed personnel. The brand on the ransom note changes. The door they walk through usually does not.