U.S. authorities have unveiled charges against Rostislav Panev, a dual Russian-Israeli national, for his alleged role as a key developer of the notorious LockBit ransomware group. Panev, 51, was arrested in Israel in August and is currently awaiting extradition to the United States.
According to the U.S. Department of Justice, Panev played a crucial role in LockBit’s operations from its inception in 2019 through at least February 2024.
During this period, LockBit became one of the most active and destructive ransomware groups globally, targeting over 2,500 victims across 120 countries, including 1,800 in the United States.
LockBit’s victims ranged from individuals and small businesses to multinational corporations, hospitals, schools, critical infrastructure, and government agencies.
The group allegedly extracted at least $500 million in ransom payments and caused billions of dollars in additional losses.
Investigate Real-World Malicious Links, Malware & Phishing Attacks With ANY.RUN – Try for Free
As a developer, Panev is accused of designing malware code and maintaining the infrastructure used by LockBit. Law enforcement discovered administrator credentials on Panev’s computer for a dark web repository containing LockBit ransomware source code and tools for customizing attacks.
Panev’s Role as Developer
Following his arrest, Panev reportedly admitted to Israeli authorities that he had performed coding, development, and consulting work for LockBit. He acknowledged creating code to disable antivirus software, spread malware across victim networks, and print ransom notes on all connected printers.
Court documents indicate that between June 2022 and February 2024, Panev received monthly cryptocurrency transfers of approximately $10,000 from LockBit’s primary administrator, totaling over $230,000.
Panev’s arrest is part of a larger effort to dismantle the LockBit organization. In February, a coordinated operation led by the U.K.’s National Crime Agency, in cooperation with the FBI and U.S. Justice Department, disrupted LockBit’s infrastructure.
To date, seven LockBit members have been charged in the District of New Jersey, with three now in custody. Authorities continue to pursue other key figures, including Dmitry Khoroshev, believed to be LockBit’s primary creator and administrator.
The U.S. Department of State is offering rewards of up to $10 million for information leading to the arrest of LockBit’s leadership and up to $5 million for information on individuals participating in LockBit activities.
As the investigation continues, authorities urge LockBit victims to contact the FBI and submit information to assist in potential decryption efforts and ongoing criminal litigation.
2024 MITRE ATT&CK Evaluation Results for SMEs & MSPs -> Download Free Guide