US charges Russian-Israeli dual national tied to Lockbit ransomware group

The United States has charged a Russian-Israeli dual citizen over alleged involvement with the Lockbit ransomware group, the US Department of Justice says.

Rostislav Panev, 51, was arrested in Israel in August and is awaiting extradition to the United States, the department says.

Panev was a developer at Lockbit from its inception some time in 2019 through to at least February 2024, during which time the group grew into “what was, at times, the most active and destructive ransomware group in the world,” the DOJ says.

“The Justice Department’s work going after the world’s most dangerous ransomware schemes includes not only dismantling networks, but also finding and bringing to justice the individuals responsible for building and running them,” Attorney General Merrick Garland says in a statement.

The US DOJ has charged, Rostislav Panev, a Russian and Israeli national for his involvement in the development of the LockBit ransomware and management of their infrastructure.

Panev was arrested in August while in Israel, and is awaiting extradition to the US.

He looks scary pic.twitter.com/cUljlHKsJN

— vxdb (@vxdb) December 20, 2024

Lockbit and its malware were linked to attacks on more than 2,500 victims in at least 120 countries around the world, according to the DOJ, including small businesses and large multinationals, hospitals, schools, critical infrastructure, government and law enforcement agencies.

Lockbit was discovered in 2020 when its eponymous malicious software was found on Russian-language cybercrime forums.

It operated as ransomware-as-a-service operation, where a core group of developers and administrators worked with “affiliates” who carried out attacks. Extortion proceeds were split between the parties involved.

Lockbit and its affiliates extorted at least $500 million in payments from victims, according to the DOJ, as well as causing significant costs from lost revenue and incident response and recovery.