A Russian national has been charged for his role in multiple ransomware and cyber attacks against computer systems in the United States and around the world, the U.S. Department of Justice (DOJ) announced recently.
Ruslan Magomedovich Astamirov, 20, of Chechen Republic, was charged with "conspiring to commit wire fraud and conspiring to intentionally damage protected computers and to transmit ransom demands," the DOJ announced June 15. Astamirov allegedly was involved with the LockBit ransomware campaign from early August 2020 to March 2023 "to commit wire fraud and to intentionally damage protected computers and make ransom demands through the use and deployment of ransomware," the news release reports, including directly executing at least five attacks.
The arrest of Astamirov was the second arrest related to LockBit crimes in the past six months, according to Deputy Attorney General Lisa Monaco, and "underscores the Justice Department’s unwavering commitment to hold ransomware actors accountable."
“In securing the arrest of a second Russian national affiliated with the LockBit ransomware," Monaco said in the release, "the Department has once again demonstrated the long arm of the law. We will continue to use every tool at our disposal to disrupt cybercrime, and while cybercriminals may continue to run, they ultimately cannot hide.”
Astamirov owned, controlled and utilized multiple email and Internet Protocol (IP) addresses and various internet provider accounts that Astamirov and his co-conspirators utilized to launch their cyberattacks and to communicate with victims, according to the release. Law enforcement was able to follow a ransom payment to a virtual currency address controlled by Astamirov in at least one instance, the release reports.
The LockBit ransomware version first surfaced around January 2020, according to the release. Since then, LockBit attackers have carried out more than 1,400 attacks in the U.S. and globally, demanded more than $100 million in ransom payments and collected tens of millions of dollars in actual extortion payments, the DOJ reports in the release.
The arrest of Astamirov comes after the DOJ filed LockBit-related charges against two other individuals, the release reports. Criminal charges were filed against Mikhail Vasiliev, a dual Russian and Canadian national currently awaiting extradition to the U.S. from Canada where he is in custody; and against Mikhail Pavlovich Matveev, "aka Wazawaka, aka m1x, aka Boriselcin, aka Uhodiransomwar," for alleged participation in separate conspiracies to deploy LockBit and other ransomware variants.
Paul Abbate, Federal Bureau of Investigations (FBI) deputy director, said in the release that "(t)he FBI is committed to pursuing ransomware actors like Astamirov, who have exploited vulnerable cyber ecosystems and harmed victims."
“We, in collaboration with our federal and international partners, are fully committed to the permanent dismantlement of these types of ransomware campaigns that intentionally target people and our private sector partners," Abbate said in the release. "We will continue to leverage every resource to prevent this type of malicious, criminal activity.”
