The ransomware economy is restless. According to CSO Online, major crews shut down under law-enforcement pressure, splinter over internal disputes or quietly rebrand once they attract too much heat. The result is a fluid marketplace where affiliates migrate between operators and groups rise and fall in months, not years.
LockBit, the long-time dominant player, is still on the list, but no longer on top. A February 2024 international takedown dubbed Operation Cronos seized its infrastructure, exposed its admin and cost it the trust of its own affiliates. New names have rushed into the vacuum.
The short version
- LockBit first appeared in 2019 and dominated through 2022 and 2023 after the releases of LockBit 2.0 and 3.0.
- In February 2024, agencies from 10 countries disrupted LockBit by seizing websites and servers in Operation Cronos.
- Investigators publicly named the alleged administrator and the US State Department posted a reward worth $10 million for tips leading to his arrest.
- After the takedown, LockBit lost its number-one spot to Play in April 2024, though it still posted more than twice as many victims as Play in the first half of the year.
- Play ransomware, active since 2022, uses intermittent encryption and appends the .play extension to files.
- Other groups referenced as active in 2024 include RansomHub, BlackCat (ALPHV), Conti, Ryuk, REvil and Maze.
How we got here
Ransomware matured into a service economy. Modern crews operate as platforms, renting their encryptors and leak sites to outnames, known as affiliates, who do the actual intrusions. Affiliates keep a large cut of any ransom, which means platform operators compete on commission, tooling and, crucially, perceived safety from law enforcement. When a group gets too much attention, two things tend to happen: police try to seize its infrastructure, and affiliates quietly move to a quieter brand.
Our analysis
LockBit's story is the clearest case study of that dynamic. It grew fast on the corpses of Ryuk, REvil, Maze and Conti, picking up their affiliates with better terms. Then Operation Cronos flipped the script: the same affiliates who trusted LockBit's operational security watched investigators walk through the front door with decryption keys and indictments. Trust does not return from that.
The interesting structural question is whether takedowns actually dent the overall attack volume, or merely shuffle affiliates between brands. The reference suggests the second: LockBit is wounded but still active, RansomHub and Play have absorbed ex-LockBit talent, and techniques like Play's intermittent encryption are getting faster and quieter. That is not a victory for defenders; it is a reorganisation of the supply side.
Say you are a CISO briefing your board
Walk them through one simple comparison: LockBit before February 2024 versus LockBit today. Same name, similar encryptor lineage, materially smaller pipeline of willing affiliates. The lesson is not that the threat is gone, it is that the threat now spreads across more groups, each with shorter brand lifespans. Defensive priorities shift accordingly. Detection and response capability matters more than brand-specific IOC lists, because the brand on the ransom note may be new next quarter.
Who should care
- CISOs and security leaders: a takedown does not mean exposure is reduced; expect rebrands and tool reuse.
- IT operations: intermittent encryption compresses detection windows, so behavioural monitoring beats signature-based alerting.
- Insurance underwriters: the affiliate churn shortens claims timelines and complicates attribution.
- Law-enforcement partners: public bounties tied to named admins raise the personal cost of running a major operation.
- SMBs without dedicated SOCs: still the easiest prey; assume the next group will reuse the last group's playbook.
What to watch next
Watch for the next "name and shame" bounty. The LockBit reward publicly attached a face to a brand, and that move raised the personal price tag for anyone running a major operation. If similar bounties hit Play or RansomHub admins, expect quieter rebrands and faster affiliate migration. The pattern is now established: visibility kills margins.
Key takeaways
- LockBit remains active post-takedown but has lost affiliate trust, opening the door for Play, RansomHub and other groups.
- Law-enforcement disruption changes affiliate loyalty faster than it changes total attack volume.
- Defenders should prioritise detection and response over brand-specific indicators of compromise.
Frequently asked questions
What is Operation Cronos?
A February 2024 operation involving agencies from 10 countries that seized LockBit's websites and servers, identified affiliates and publicly named the alleged administrator.
Who has been named as the LockBit administrator?
Investigators publicly named a 31-year-old Russian national from Voronezh as the alleged operator behind the LockBit service and posted a $10 million US State Department reward for tips leading to his arrest.
Is LockBit still active in 2024?
Yes. The reference says LockBit led victim postings in the first half of 2024 per Palo Alto Networks, and sat behind RansomHub in July per NCC Group data.
What makes Play ransomware different technically?
Play uses intermittent encryption, encrypting only specific-sized chunks of files for speed and stealth, and appends the .play extension to impacted files.
Why do ransomware groups rebrand so often?
Affiliates migrate when law-enforcement pressure or operational-security failures erode trust, and groups rebrand to shed heat and recruit fresh affiliates.