LockBit ransomware group, has been extradited to the United States
A 51-year-old dual citizen of Russia and Israel, accused of being a developer for the LockBit ransomware group, has been extradited to the United States nearly three months after being formally charged for his involvement in the cybercrime operation.
Rostislav Panev was arrested in Israel in August 2024. Authorities claim he worked as a developer for the ransomware gang from 2019 until February 2024, when law enforcement took down the group's online infrastructure. "Rostislav Panev's extradition to the District of New Jersey makes it clear: if you are a member of the LockBit ransomware conspiracy, the United States will find you and bring you to justice," stated U.S. Attorney John Giordano.
LockBit became one of the most notorious ransomware groups, targeting over 2,500 organizations across at least 120 countries, with nearly 1,800 of those attacks occurring in the United States. Their victims ranged from individuals and small businesses to multinational corporations, hospitals, schools, nonprofit organizations, and even government and law enforcement agencies.
The group's cybercrime activities have resulted in at least $500 million in illegal profits, causing billions of dollars in damages, including lost revenue and expenses for incident response and recovery. As a developer for LockBit, Panev played a key role in designing and maintaining the ransomware’s codebase, earning approximately $230,000 between June 2022 and February 2024.
"Panev admitted to developing code that disabled antivirus software, deployed malware across victim networks, and printed LockBit ransom notes on all connected printers," the Justice Department stated. "He also confessed to writing and maintaining LockBit’s malware code and providing technical support to the group."
Besides Panev, six other LockBit members—Mikhail Vasiliev, Ruslan Astamirov, Artur Sungatov, Ivan Gennadievich Kondratiev, Mikhail Pavlovich Matveev, and Dmitry Yuryevich Khoroshev—have been charged in the U.S. Khoroshev, known online as LockBitSupp, has been identified as the group's administrator.
Additionally, Khoroshev, Matveev, Sungatov, and Kondratiev have been sanctioned by the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) for their roles in orchestrating cyberattacks.
