The UK’s National Crime Agency (NCA) has shared details of an international disruption campaign targeting what it describes as the “world’s most harmful cyber-crime group”.

After infiltrating the group’s network on Tuesday, the NCA has taken control of Lockbit’s services, compromising the cyber gang’s entire criminal network.

The NCA, working closely with the FBI, and supported by international partners from nine other countries, has been covertly investigating LockBit as part of a dedicated taskforce called Operation Cronos.

Lockbit has been in operation for four years, during which criminals have attacked thousands of victims around the world using the the group's ransomware-as-a-service.

Billions of pounds, dollars and euros have been lost to both ransom payments and in the costs of recovery over the period.

The group provided ransomware-as-a-service to a global network of hackers or ‘affiliates’, supplying them with the tools and infrastructure required to carry out these attacks.

When a victim’s network is infected by LockBit’s malicious software, their data is stolen and their systems encrypted.

Following an attack, a ransom is demanded in cryptocurrency for the victim to decrypt their files and prevent their data from being published.

However, the NCA found evidence that data belonging to victims who had paid a ransom to criminals was still stored in Lockbit's systems.

The Agency said that it has taken control of LockBit’s primary administration environment, which enabled affiliates to build and carry out attacks, and the group’s public-facing leak site on the dark web, on which it previously hosted, and threatened to publish, data stolen from victims.

The website is now set to host a series of information exposing LockBit’s capability and operations, which the NCA will be posting daily throughout the week.

The UK's crime watchdog has also now obtained the LockBit platform’s source code and a "vast amount of intelligence" from its systems about its activities and those who have worked with them and used their services to harm organisations throughout the world.

“This NCA-led investigation is a ground-breaking disruption of the world’s most harmful cyber crime group," said NCA director general Graeme Biggar. "It shows that no criminal operation, wherever they are, and no matter how advanced, is beyond the reach of the Agency and our partners."

He continued: “Through our close collaboration, we have hacked the hackers; taken control of their infrastructure, seized their source code, and obtained keys that will help victims decrypt their systems. As of today, LockBit are locked out. We have damaged the capability and most notably, the credibility of a group that depended on secrecy and anonymity."

Biggar went on to say that Lockbit might try to rebuild its criminal enterprise but that the NCA would "not stop" in its efforts to target the group and anyone associated with them.

In wider action coordinated by Europol, two LockBit actors were arrested on Tuesday morning in Poland and Ukraine, while over 200 cryptocurrency accounts linked to the group have also been frozen.

Additionally, the US Department of Justice has announced that two defendants responsible for using LockBit to carry out ransomware attacks have been criminally charged and are currently in custody.

The US has also unsealed indictments against two further individuals, who are Russian nationals, for conspiring to commit LockBit attacks.

“The National Crime Agency’s world leading expertise has delivered a major blow to the people behind the most prolific ransomware strain in the world," said home secretary James Cleverly. “The criminals running LockBit are sophisticated and highly organised, but they have not been able to escape the arm of UK law enforcement and our international partners.

“The UK has severely disrupted their sinister ambitions and we will continue going after criminal groups who target our businesses and institutions.”

---