LIVE
TRACECHAIN™FORENSICS
FRAUD INTELLIGENCE · CASE FILES · GLOBAL SCOREBOARD
REPORT FRAUD Find your country and who to contact ▸🔍 Search cases, companies, countries, agencies
INTEL
PIG BUTCHERING: now the #1 loss category in the US by estimated volume / HUSHPUPPI: the Instagram that became the evidence -- Case 001 open / BEC: one spoofed email, one wire, seven figures -- see the methodology / ROSS ULBRICHT: full pardon January 21 2025 after 11+ years -- Case 013 open / ALL FIGURES LABELED: estimate vs conviction vs market collapse -- see Methodology / UNODC 2023: $5.4B estimated annually from SE Asia pig-butchering compounds [UNVERIFIED] / PIG BUTCHERING: now the #1 loss category in the US by estimated volume / HUSHPUPPI: the Instagram that became the evidence -- Case 001 open / BEC: one spoofed email, one wire, seven figures -- see the methodology / ROSS ULBRICHT: full pardon January 21 2025 after 11+ years -- Case 013 open / ALL FIGURES LABELED: estimate vs conviction vs market collapse -- see Methodology / UNODC 2023: $5.4B estimated annually from SE Asia pig-butchering compounds [UNVERIFIED]
◂ ALL COMPANIES◂ ALL CASES
COMPANY · GROUP/MALWARE

LockBit

🇷🇺 Russia (administrator in Voronezh) · FOUNDED 2019-09
THE FIGURE
~$500M
Ransoms LockBit and its affiliates extorted from over 2,500 victims (indictment; alleged). Khoroshev's own alleged share: at least $100M.
WHAT IT SAID IT WAS

A ransomware-as-a-service platform: developers rented the malware and leak site to affiliates who broke into victims and split the ransoms.

WHAT IT REALLY WAS

The most prolific ransomware operation of its time — over 2,500 victims in 120 countries and at least $500M in ransoms from September 2019 to February 2024, per the US indictment.

THE STORY

LockBit appeared in September 2019 and by 2022 was the world's busiest ransomware brand, renting its encryptor and leak site to affiliates for a cut of the ransoms and running a bug bounty and PR stunts. On 19 February 2024 the UK's National Crime Agency, the FBI and Europol seized its servers in Operation Cronos, turned its own leak site into a trolling countdown and recovered over a thousand decryption keys. In May 2024 they named its administrator as Dmitry Khoroshev of Voronezh, indicted and sanctioned him and offered $10 million for his arrest. He, and affiliate Mikhail Matveev, remain in Russia.

WHO RAN IT
Dmitry Khoroshev ▸
developer and administrator ('LockBitSupp') · open the case file
Mikhail Matveev ▸
affiliate ('Wazawaka'), also of Babuk and Hive · open the case file
Mikhail Vasiliev
affiliate — extradited from Canada; pleaded guilty; sentenced 2024
Aleksandr Ryzhenkov ('Beverley')
Evil Corp member and LockBit affiliate — sanctioned and indicted October 2024
WHO WAS HURT
Royal MailBoeingICBC's US armhospitals, schools and 2,500+ organisations worldwide
HOW IT ENDED
Founded
2019-09
Based
Russia (administrator in Voronezh)
Ended
2024-02-19
How
seized — Operation Cronos (NCA, FBI, Europol) took its infrastructure and leak site 19 February 2024; remnants resurfaced but diminished

34 servers seized, 200+ crypto accounts frozen, 1,000+ decryption keys recovered; two affiliates arrested in Poland and Ukraine. Khoroshev named, indicted (26 counts, New Jersey) and sanctioned by the US, UK and Australia on 7 May 2024 with a $10M reward. Affiliates Mikhail Vasiliev (Canada, 4 years, 2024), Ruslan Astamirov and Artur Sungatov also charged; Evil Corp's Aleksandr Ryzhenkov exposed as an affiliate (October 2024).

SOURCES
nationalcrimeagency.gov.uk/news/lockbit-leader-unmasked-and-sanctionedweforum.org/stories/2024/02/lockbit-ransomware-operation-cronos-cyberc
Facts as published in court records, regulator releases and the sources above. Anyone charged and not convicted is alleged only.
🏠 HOME📁 CASES🚨 WANTED🎮 PLAY🌍 WORLD