LockBit Resurfaced Eighteen Months After Operation Cronos

LockBit released a new version of its ransomware in September 2025. The operation had been the target of Operation Cronos in early 2024, in which the UK National Crime Agency and partners took control of its infrastructure, compromised its backend, named members of its leadership and recovered decryption keys.

Cronos was not a domain seizure. Investigators held the operation’s own systems, published its affiliate structure, released keys that let victims recover without paying, and identified individuals publicly.

It also inflicted the damage that matters most in a criminal market: it destroyed the operation’s credibility with its own affiliates. An affiliate chooses a platform on the basis that it works and that the operators can be relied on to pay out. Cronos demonstrated both were compromised.

This desk cannot establish who is behind the new release. Recovered brands in this ecosystem are sometimes the original operators, sometimes acquirers of the name, and sometimes unrelated parties trading on recognition.

The observation that holds regardless is that the name survived a disruption designed to destroy it. In a market where reputation is the scarce asset — the point made at 25-1014 — a recognised brand retains value even after being demonstrably compromised.

The more consequential outcome of Cronos was not LockBit’s absence but where its affiliates went. Reporting describes Akira, PLAY and RansomHub absorbing the share, and the fragmentation file at 25-1226 records 2025 ending with a record number of groups.

Removing the largest operator in a market did not reduce the market. It redistributed it into more numerous, smaller, less trackable operations — which is a worse position for defenders and investigators than the one before, and is not how the intervention is usually scored.

Graded medium: the disruption and the release are well reported, and the identity of those behind the 2025 version is not established.