On December 20, additional criminal charges were filed in the United States against Rostislav Panev, a 51-year-old Russian-Israeli citizen suspected of developing malicious code for the LockBit group.
In August 2024, Rostislav Panev was detained in Israel at the request of the United States and is currently awaiting extradition. He is charged with 41 counts, including conspiracy to commit fraud, willful damage to protected computers, and extortion.
According to the additional indictment, Panev was a LockBit developer since 2019 and was responsible for creating and maintaining the malware, including tools to disable antivirus, infect networks, and print ransom demands on all victims’ printers.
It is also alleged that Panev exchanged direct messages with the chief administrator of LockBit. According to the indictment, it is Dmitry Yurievich Khoroshev. These messages included discussion about work that needed to be done with LockBit’s designer and control panel. We’ve previously written about Khoroshev: 10 million for information about the LockBit organizer.
At the time of the arrest, Israeli police found such data in the Panev’s computer:
- Administrative credentials for an online darknet repository that held the source code for several versions of LockBit, as well as the source code for the StealBit data theft tool
- Access to the LockBit dashboard, an online board maintained by LockBit developers for their partners
Throughout the time, he received $230,000 in monthly cryptocurrency payments from LockBit administrators.
According to the US Department of Justice, the LockBit group and its affiliates attacked over 2,500 victims (both individuals and organizations) worldwide, about 1,800 victims were from the US. Hackers obtained at least $500 million in ransom payments from their victims and caused billions of dollars in losses, including lost profits and incident response and recovery costs.
“The Justice Department’s work going after the world’s most dangerous ransomware schemes includes not only dismantling networks but also finding and bringing to justice the individuals responsible for building and running them,” said Attorney General Merrick B. Garland.
In addition to Panev, seven other key LockBit members, including Dmitry Khoroshev, the alleged leader of the group, have been indicted. Khoroshev and others involved in the case are wanted.
The U.S. Department of Foreign Affairs is offering the following rewards:
- A reward of up to $10 million for information that will help apprehend and prosecute Dmitry Yurievich Khoroshev.
- Up to $10 million for information leading to the apprehension and prosecution of Mikhail Matveev.
- Up to $10 million for assistance in identifying and locating individuals in key leadership positions within the LockBit organization.
- Up to $5 million for providing data that will lead to the arrest or conviction of any participant or person planning to participate in the LockBit group’s activities.
- Official press release from the U.S. Department of Justice: https://www.justice.gov/opa/pr/united-states-charges-dual-russian-and-israeli-national-developer-lockbit-ransomware-group.
- Copy of the previous criminal complaint: https://www.justice.gov/media/1381806/dl
