International Law Enforcement on Ransomware: Operation Cronos and LockBit 3.0

Clicks: 11
ID: 334076
2026
Free PDF
Article Quality & Performance Metrics
Overall Quality
Not rated
Combines reader engagement with the AI quality analysis. This article has not been analysed, so there is no overall score — reader engagement is measured and shown alongside.
AI Quality Assessment
Not analyzed
Readership in this journal
Emerging

Ranked #81 of 85 articles by views in political science quarterly

Most read Least read

Bar heights use a square-root scale.

Mint this article as an NFT
Not yet minted

Create a permanent, verifiable on-chain record of this article on the Scimatic Network. The NFT is held in your Journament account, and you can withdraw it to your own wallet at any time.

5 SUSD one-off · no wallet required
Sign in to mint
Abstract
Abstract This article probes the effectiveness of international law enforcement operations against major hacking organizations. I adopt a two-step approach. First, I examine 13 multilateral counter-ransomware campaigns conducted between 2014 and 2025. I determine that 85 percent of them achieved their intended aims and led to the termination of group activities. Only two of thirteen groups (15 percent) were able to return to business. However, the high success rate involved structural constraints on operations, which limited their long-term impact, and the overall number of ransomware groups continued to grow during the same period. Second, I conduct a within-case analysis that traced the process of Operation Cronos—a 2024 takedown of LockBit 3.0—one of the most harmful groups to date. My analysis shows mixed results. On the one hand, participating agencies achieved many intended objectives and left damage on the ransomware industry. For a while, the operation helped reduce illicit activity and the sum of ransom paid by victims. On the other hand, LockBit returned to business shortly after the operation and carried out new attacks, although on a lesser scale than before the takedown. Despite the operation, ransomware payments and average amounts of stolen cryptocurrency increased, and many groups and affiliates remain at large. In sum, although the effects of Operation Cronos were considerable, they were limited in temporal terms and in its impact on the cybersecurity landscape.
Reference Key
openalex_W7223667702 Use this key to autocite in the manuscript while using SciMatic Manuscript Manager or Thesis Manager
Authors Nori Katagiri
Are you one of these authors? Claim your profile
Journal political science quarterly
Year 2026
DOI
10.1093/psquar/qqag085
URL
https://doi.org/10.1093/psquar/qqag085
Keywords Keywords not found

Citations

No citations found. To add a citation, contact the admin at info@scimatic.org

Comments

No comments yet. Be the first to comment on this article.