Operation Cronos: A Breakdown of the LockBit Disruption

**Executive summary:** Operation Cronos (19–24 Feb 2024) was an international law enforcement disruption of the LockBit 3.0 ransomware operation: authorities seized and repurposed LockBit leak sites to publish evidence, exfiltrated backend data (including admin panels and affiliate lists), dismantled StealBit exfiltration servers, referred for closure thousands of rogue accounts, secured indictments, arrests and sanctions, and worked with partners (Europol, IC3, Chainalysis, Japan police) to provide decryptors and victim support — a significant disruption that did not fully dismantle the ransomware ecosystem.