Cover Image for United States brings charges against the alleged developer of the LockBit ransomware.
Sat Dec 21 2024

United States brings charges against the alleged developer of the LockBit ransomware.

It is said that he/she received more than $230,000 for his/her work.

A citizen with dual Russian and Israeli nationality has been charged by the U.S. government with developing and maintaining the LockBit malware code, after receiving over $230,000 in cryptocurrency for his work. Rostislav Panev, 51, was arrested in Israel while awaiting extradition to the U.S., becoming the third member of the LockBit ransomware group to be taken into custody.

Authorities had already detained other alleged members of LockBit, such as Mikhail Vasiliev and Ruslan Magomedovich Astamirov, who pleaded guilty to several charges, including conspiracy to commit computer fraud. The alleged leader of LockBit, Dmitry Khoroshev, is currently sought, with a reward of up to $10 million for his capture. In May, the DOJ stated that "Khoroshev, for his part, allegedly received at least $100 million in digital currency payments through his role as a developer in LockBit ransom payments," based on a 20% cut of the ransom payments extorted by affiliates using the group's software.

According to the indictment, Panev has worked as a LockBit developer since its creation in 2019, participating in ransomware attacks targeting numerous entities around the world, including hospitals, businesses, and government agencies. Police were able to link Panev to LockBit after finding access credentials on his computer for a repository on the dark web that hosted "multiple versions of the LockBit builder," a tool that allows members to "generate customized versions of the LockBit ransomware malware for specific victims."

Panev allegedly admitted to having written and maintained the LockBit malware code in interviews with Israeli police. It is claimed that part of the code he created can disable Windows Defender antivirus software, execute malware on multiple computers within a network, and deploy the LockBit ransom note on all printers in the victim's network. According to the indictment, Panev stated that he initially did not realize he was participating in illegal activities.