One of the the largest ransomware outfits in the world has been magnificently trolled by the Swedish police and Europol

Man in sunglasses staring at a screen full of digits.
(Image credit: Getty Images)

Well well well, how the turntables have...you get the idea. Lockbit, a notorious ransomware syndicate that's estimated to have extorted more than $120 million of ill-gotten gains from victims worldwide, has been subjected to a successful takedown operation from a group comprising a range of international authorities, including the Swedish police and Europol. 

The best part? Rather than simply lock the dark website down, the investigators took the opportunity to do a bit of trolling of their own.

Not content with merely gaining root access to the ransomware group's servers, the authorities, operating under the title "Operation Cronos", decided to have a bit of schadenfreude-inducing fun while they were at it (via Ars Technica). In a series of images displayed on the sites Lockbit previously operated, the investigators not only revealed the extent of the access they had obtained—including control of the main web panel that Lockbit operators used to communicate with their victims—but teased the founder, operating under the name LockbitSupp, in a manner they may well be familiar with.

A page on the main site read "Who is LockbitSupp? The $10m question", complete with a timer counting down the seconds until their identifying information would be posted. This mirrored a common method of extortion used by Lockbit operators to extort large sums of money from victims, in which they taunted their potential prey and gave them an ebbing timeframe in which to pay up.

Not only that, but the images themselves featured filenames that appear to brag about the extent of the operation's success, with some highlights including "this_is_really-bad.png" and "doesnt_look_good.png".

The months-long operation has been regarded as a major victory in the fight against ransomware operators, with 34 servers in the Netherlands, Germany, Finland, France, Sweden, and more taken down once the authorities had had their fun. Two arrests have been made so far, with three international arrest warrants and five indictments also issued by French and US authorities.

Lockbit previously operated as a ransomware-as-a-service operation, where malware was distributed by a core team within the group to various "affiliates" who would then put it to use blackmailing victims into handing over their cash. The group and its operators often made use of encryption tools to lock users' data, before threatening to leak it while performing DDoS attacks to ramp up the pressure, in a method referred to as triple extortion.

Thinking of upgrading?

Windows 11 Square logo

(Image credit: Microsoft)

Windows 11 review: What we think of the latest OS.
How to install Windows 11: Our guide to a secure install.
Windows 11 TPM requirement: Strict OS security.

14,000 accounts used by Lockbit are now under the control of law enforcement as a result of the operation, which took a huge amount of cooperation between various agencies to bring to fruition. While Lockbit is far from the only ransomware syndicate operating on the dark web, it was certainly one of the largest, and its takedown may well serve as a warning to others hoping to mimic its success.

Not only are the authorities coming, it seems, but if they make it past your digital walls they may well perform a victory lap over the ashes of your criminal empire, and mock you in the process.

Still, difficult to feel too sorry for them, ey? Beyond the malware itself, shame, embarrassment, and fear were the tools of Lockbit's trade, and in this case, it seems that just desserts have just been served.

Andy Edser
Hardware Writer

Andy built his first gaming PC at the tender age of 12, when IDE cables were a thing and high resolution wasn't—and he hasn't stopped since. Now working as a hardware writer for PC Gamer, Andy's been jumping around the world attending product launches and trade shows, all the while reviewing every bit of PC hardware he can get his hands on. You name it, if it's interesting hardware he'll write words about it, with opinions and everything.

Read more
Three Magikarp Pokémon
The FBI used self-destruct on malware infecting over 4,000 US computers, it's super effective
 In this photo illustration a novelty Bitcoin token is photographed on a US Dollar bank note, on January 4, 2025 in Bath, England. The Cryptocurrency market has recently received a significant boost by the election of Donald Trump with hopes of the start of a policy framework that could see Bitcoin as a strategic asset
Man charged with $65,000,000 worth of cryptocurrency heists was reportedly discovered through chatting on Discord with a company they allegedly stole from
Steam logo
A web3 free-to-play survival game found to be a front for installing malware on your PC has finally been removed from Steam
An FBI wanted poster for alleged hacker Zhou Shuai.
US Justice Dept announces $10 million bounty on at-large 'hacker-for-hire' cabal it says targeted China critics, religious missionaries, and the Treasury
Hacker
$1.5 billion crypto heist could be the biggest yet, more than doubling the previous record, but don't worry: The affected firm says it can take the hit
Kinzie, in an FBI jacket, uses a computer with the logo of the Third Street Saints on it
Have I Been Pwned adds over 284 million compromised passwords from latest breach
Latest in Security
An FBI wanted poster for alleged hacker Zhou Shuai.
US Justice Dept announces $10 million bounty on at-large 'hacker-for-hire' cabal it says targeted China critics, religious missionaries, and the Treasury
Kinzie, in an FBI jacket, uses a computer with the logo of the Third Street Saints on it
Have I Been Pwned adds over 284 million compromised passwords from latest breach
A still from a YouTube video of Senator Mark Warner speaking
Telecoms hack on US government officials is 'worst in nations history' and 'the barn door is still wide open' says senator
HDMI cable
Hackers can wirelessly spy on your display by collecting HDMI signal leaks and churning them through an AI, but I wouldn't break out the tin foil just yet
Computer code and text displayed on computer screens. Photographer: Chris Ratcliffe/Bloomberg
Forcing users to periodically change their passwords should go the way of the dodo according to the US government
An original Apple Macintosh Model M0001, as they celebrate 40th anniversary, is on display in between 2024 Apple models at the independent Apple products store chain Amac, on January 24, 2024 in Utrecht, The Netherlands. Based on the Motorola 68000 microprocessor, the Macintosh was the first successful mouse-driven computer with a graphical user interface.
Major browser providers scramble to patch an 18-year-old vulnerability affecting MacOS and Linux systems but Windows remains gloriously immune
Latest in News
Naoe looking at the wrist blade in Assassin's Creed Shadows
Ubisoft backflips, says Assassin's Creed Shadows will support Steam Deck at launch, but I doubt I'll actually want to play it there
Henry from KCD2 wearing nice outfits
'Diversify your fashion endgame' with this Kingdom Come: Deliverance 2 mod that gives Henry fly new gambesons, pourpoints, and caftans
Masked Counter-Terrorist in helmet in forefront with sunglasses and beret-wearing CT in background touching headset
There's hope yet for Classic Offensive after its Steam rejection: The team behind the Counter-Strike 1.6 revival mod is in touch with Valve about its 'concerns'
Recently appointed Intel CEO Lip-Bu Tan.
Here comes Intel's new CEO: a semiconductor veteran that won the same prestigious award as Jensen Huang and Lisa Su
BURBANK, CALIFORNIA - AUGUST 15: Protestors attend the SAG-AFTRA Video Game Strike Picket on August 15, 2024 in Burbank, California. (Photo by Lila Seeley/Getty Images)
8 months into their strike, videogame voice actors say the industry's latest proposal is 'filled with alarming loopholes that will leave our members vulnerable to AI abuse'
Orithopter shooting down another in Dune
Dune: Awakening confirms air-to-air combat in ornithopters