WASHINGTON (Reuters) — The United States has charged a Russian-Israeli dual citizen over alleged involvement with the Lockbit ransomware group, the US Department of Justice said in a statement on Friday.
Rostislav Panev, 51, was arrested in Israel in August and is awaiting extradition to the United States, the department said.
Panev was a developer at Lockbit from its inception sometime in 2019 through to at least February 2024, during which time the group grew into “what was, at times, the most active and destructive ransomware group in the world,” the DOJ said.
“The Justice Department’s work going after the world’s most dangerous ransomware schemes includes not only dismantling networks, but also finding and bringing to justice the individuals responsible for building and running them,” US Attorney General Merrick Garland said in a statement.
Lockbit and its malware were linked to attacks on more than 2,500 victims in at least 120 countries around the world, according to the DOJ, including small businesses and large multinationals, hospitals, schools, critical infrastructure, government and law enforcement agencies.
Lockbit was discovered in 2020 when its eponymous malicious software was found on Russian-language cybercrime forums.
Attorney General Merrick Garland speaks during a news conference at the Department of Justice headquarters in Washington, Thursday, June 27, 2024.(AP Photo/Jose Luis Magana)
It operated as a ransomware-as-a-service operation, where a core group of developers and administrators worked with “affiliates” who carried out attacks. Extortion proceeds were split between the parties involved.
Lockbit and its affiliates extorted at least $500 million in payments from victims, according to the DOJ, as well as causing significant costs from lost revenue and incident response and recovery.
The arrest follows two guilty pleas in July from a pair of Russian members of the Lockbit gang — Ruslan Astamirov and Mikhail Vasiliev — and the seizure, in February, of numerous Lockbit websites by Britain’s National Crime Agency, the FBI, and other international law enforcement agencies.
Lockbit reappeared online not long after the seizure, defiantly saying: “I cannot be stopped.” But law enforcement officials and experts say the bust helped damage the gang’s standing in the cybercriminal underworld.
Watch Docu Nation Season 2: Resilience
when you join the ToI Community
Support The Times of Israel’s independent journalism and receive access to our documentary series, Docu Nation: Resilience, premiering December 12.
In this season of Docu Nation, you can stream eight outstanding Israeli documentaries with English subtitles and then join a live online discussion with the filmmakers. The selected films show how resilience, hope, and growth can emerge from crisis.
When you watch Docu Nation, you’re also supporting Israeli creators at a time when it’s increasingly difficult for them to share their work globally.
To learn more about Docu Nation: Resilience, click here.
Support ToI and get Docu Nation
Support ToI and get Docu Nation
Already a member? Sign in to stop seeing this
You’re a dedicated reader
We’re really pleased that you’ve read X Times of Israel articles in the past month.
That’s why we started the Times of Israel eleven years ago – to provide discerning readers like you with must-read coverage of Israel and the Jewish world.
So now we have a request. Unlike other news outlets, we haven’t put up a paywall. But as the journalism we do is costly, we invite readers for whom The Times of Israel has become important to help support our work by joining The Times of Israel Community.
For as little as $6 a month you can help support our quality journalism while enjoying The Times of Israel AD-FREE, as well as accessing exclusive content available only to Times of Israel Community members.
Thank you,
David Horovitz, Founding Editor of The Times of Israel
Join Our Community
Join Our Community
Already a member? Sign in to stop seeing this
!function(f,b,e,v,n,t,s)
{if(f.fbq)return;n=f.fbq=function(){n.callMethod?
n.callMethod.apply(n,arguments):n.queue.push(arguments)};
if(!f._fbq)f._fbq=n;n.push=n;n.loaded=!0;n.version=’2.0′;
n.queue=[];t=b.createElement(e);t.async=!0;
t.src=v;s=b.getElementsByTagName(e)[0];
s.parentNode.insertBefore(t,s)}(window, document,’script’,
‘https://connect.facebook.net/en_US/fbevents.js’);
fbq(‘init’, ‘272776440645465’);
fbq(‘track’, ‘PageView’);
