The Effect of Deterrence on Ransomware Gangs: Operation Cronos and the Takedown of Lockbit

• In Event: Mapping and Disrupting Ransomware: Structures, Spaces, and Investigation

Abstract

Law enforcement cybercrime operations are often seen as a net positive that deter other cybercriminals from engaging in cybercrime. This study seeks to test the potential deterrent effect of Operation Cronos, the law enforcement operation resulting in the takedown of the infamous ransomware gang LockBit, on other ransomware gangs. To collect data, a daily count of ransomware attacks from over 150 unique ransomware gangs was scraped from an open-source ransomware tracker. Interrupted time series analysis was performed to measure any differences in the number of attacks, type of attacks, and creation of ransomware gangs before and after Operation Cronos was conducted on February 19th, 2024. Preliminary analysis has not found any substantial changes in the activities of ransomware gangs before or after the operation, indicating that law enforcement operations might not be an effective way to combat the rise ransomware. Results of this study are relevant for any academic or policymaker seeking methods to prevent future cybercrime.

Authors

• Joshua Gerstenfeld, Georgia State University

• David Maimon, Georgia State University