Genesis Market Takedown: Sessions Are the New Passwords
Operation Cookie Monster seized the market selling browser sessions, cookies, and saved credentials for ~2M identities, with 119 arrests across 17+ countries. Session-security lessons.
LockBit Takedown: Operation Cronos and Its Awkward Aftermath
February 2024’s Operation Cronos seized LockBit’s infrastructure across a dozen countries — and then the leaks showed how long the FBI had been inside. This account covers the covert access, the sting timing driven by UK hospital targeting, the servers and affiliate accounts taken down, the hurried rebrand to LockBit 4.1, the affiliate diaspora to RansomHub and Akira, and the awkward questions the takedown’s trolling raised about reading crime statistics.
REvil Takedown: How 14 Arrests Killed Ransomware’s Worst Brand
October 2021’s FSB operation ended REvil with arrests, asset seizures, and infrastructure capture. The talent lived on elsewhere.