CYBERFIGHT™
· Back to Daily Briefing
tactical Incidents & Breacheshigh

Operation Cronos seizes LockBit infrastructure and publishes affiliate detail

Tue, Feb 20, 2024, 01:00 PM UTC·Feb 20, 2024· Cybercrime / Ransomware (CRIME)

Summary

Bottom line: international law enforcement took the leak site, recovered decryption keys and exposed the affiliate structure of the most active ransomware brand. Infrastructure seizure combined with public exposure now precedes arrests in United States practice.

Key claims· extracted from reporting

  • Bottom line: international law enforcement took the leak site, recovered decryption keys and exposed the affiliate structure of the most active ransomware brand.Low · 10%
    named entity
    Source: US Department of Justice
  • Infrastructure seizure combined with public exposure now precedes arrests in United States practice.Low · 10%
    named entity×2
    Source: US Department of Justice

Heuristic extraction, verify against the original report before citing.

Tags· click to alert

Key takeaways

The three things worth remembering from this item.

  1. 1Bottom line: Operation Cronos seizes LockBit infrastructure and publishes affiliate detail[1]
  2. 2LockBit activity is the driver here, and the objective is what should shape your response, not the tool names.[1][2]
  3. 3Defensively, the highest-leverage move is coverage for T1190 · Exploit Public-Facing Application, because it is a behavior class rather than an indicator.[1][2]

Concepts in this story

Each concept opens in layers: plain English, technical, then expert.

LockBit

Criminal · High tempo

LockBit is a Criminal linked hacking group. In plain terms, they break into healthcare, manufacturing, government and stay there. Their goal is to ransomware-as-a-service extortion at scale.

Why it matters
Criminal extortion is the most likely intrusion any US organization will actually face, and it now routinely disrupts hospitals, schools and local government.[1][2]
Common misconception
That ransomware is only an encryption problem. Data theft and extortion continue even when backups restore cleanly.
Cyber Kill ChainNIST CSF 2.0, Identify, Detect, Respond
Sources for this concept
  1. [1]LockBit disruption (Operation Cronos) unmasks affiliates after healthcare and school-district attacks· Public incident reporting· 2024-06-01 00:00Z
  2. [2]Operation Cronos seizes LockBit infrastructure and publishes affiliate detail· US Department of Justice· 2024-02-20 13:00Z

T1190 · Exploit Public-Facing Application

Initial Access · used by 13 tracked groups

Exploit Public-Facing Application is how an attacker initial access works in practice. Edge devices and VPN appliances (Ivanti, Fortinet, Citrix, Cisco) exploited within hours of CVE disclosure.

Why it matters
This is a initial access behavior, so blocking it early removes an entire branch of the intrusion rather than one tool.[1][2]
Common misconception
That a technique ID is a detection. ATT&CK describes behavior; coverage still has to be built and tested per environment.
MITRE ATT&CK T1190 Tactic: Initial Access
Sources for this concept
  1. [1]T1190 · Exploit Public-Facing Application· MITRE ATT&CK T1190
  2. [2]Operation Cronos seizes LockBit infrastructure and publishes affiliate detail· US Department of Justice· 2024-02-20 13:00Z

T1078 · Valid Accounts

Initial Access · used by 18 tracked groups

Valid Accounts is how an attacker initial access works in practice. Stolen or sprayed credentials used in place of malware, defeating signature-based detection.

Why it matters
This is a initial access behavior, so blocking it early removes an entire branch of the intrusion rather than one tool.[1][2]
Common misconception
That a technique ID is a detection. ATT&CK describes behavior; coverage still has to be built and tested per environment.
MITRE ATT&CK T1078 Tactic: Initial Access
Sources for this concept
  1. [1]T1078 · Valid Accounts· MITRE ATT&CK T1078
  2. [2]Operation Cronos seizes LockBit infrastructure and publishes affiliate detail· US Department of Justice· 2024-02-20 13:00Z

T1486 · Data Encrypted for Impact

Impact · used by 9 tracked groups

Data Encrypted for Impact is how an attacker impact works in practice. Ransomware encryption paired with extortion leak sites.

Why it matters
This is a impact behavior, so blocking it early removes an entire branch of the intrusion rather than one tool.[1][2]
Common misconception
That a technique ID is a detection. ATT&CK describes behavior; coverage still has to be built and tested per environment.
MITRE ATT&CK T1486 Tactic: Impact
Sources for this concept
  1. [1]T1486 · Data Encrypted for Impact· MITRE ATT&CK T1486
  2. [2]Operation Cronos seizes LockBit infrastructure and publishes affiliate detail· US Department of Justice· 2024-02-20 13:00Z

T1567.002 · Exfiltration to Cloud Storage

Exfiltration · used by 7 tracked groups

Exfiltration to Cloud Storage is how an attacker exfiltration works in practice. Staged archives trickled out through OneDrive, Dropbox, and similar services.

Why it matters
This is a exfiltration behavior, so blocking it early removes an entire branch of the intrusion rather than one tool.[1][2]
Common misconception
That a technique ID is a detection. ATT&CK describes behavior; coverage still has to be built and tested per environment.
MITRE ATT&CK T1567.002 Tactic: Exfiltration
Sources for this concept
  1. [1]T1567.002 · Exfiltration to Cloud Storage· MITRE ATT&CK T1567.002
  2. [2]Operation Cronos seizes LockBit infrastructure and publishes affiliate detail· US Department of Justice· 2024-02-20 13:00Z
Sources for these takeaways
  1. [1]Operation Cronos seizes LockBit infrastructure and publishes affiliate detail· US Department of Justice· 2024-02-20 13:00Z
  2. [2]LockBit disruption (Operation Cronos) unmasks affiliates after healthcare and school-district attacks· Public incident reporting· 2024-06-01 00:00Z
  3. [3]T1190 · Exploit Public-Facing Application· MITRE ATT&CK T1190

Knowledge check

Five questions. Answers explain the reasoning, not just the result.

Question 1 of 5

Which nexus is LockBit attributed to in public reporting?

Question 2 of 5

Which sector is a primary target for LockBit?

Question 3 of 5

Which ATT&CK tactic does T1190 (Exploit Public-Facing Application) belong to?

Question 4 of 5

Which ATT&CK tactic does T1078 (Valid Accounts) belong to?

Question 5 of 5

Which ATT&CK tactic does T1486 (Data Encrypted for Impact) belong to?

Answer all 5 to check.
Estimated mastery
First time on this material.
New · 0/100