A dual Russian and Israeli national, Rostislav Panev, has been extradited to the United States on charges related to his involvement with the LockBit ransomware group. Panev was arrested in Israel in August following a U.S. provisional arrest request and has now appeared before U.S. Magistrate Judge André M. Espinosa in Newark, New Jersey.
United States Attorney John Giordano emphasized the commitment of U.S. authorities to prosecute members of the LockBit ransomware conspiracy: "Rostislav Panev’s extradition to the District of New Jersey makes it clear: if you are a member of the LockBit ransomware conspiracy, the United States will find you and bring you to justice."
Acting Special Agent in Charge of the FBI Newark Division Terence G. Reilly stated, "No one is safe from ransomware attacks, from individuals to institutions... We will continue to work tirelessly to prevent actors, such as Panev, from hacking their way to financial gain."
Panev is accused of being a developer for LockBit since its inception around 2019 until at least February 2024. The group reportedly attacked over 2,500 victims globally, including significant numbers within the United States. These attacks targeted various sectors such as healthcare, education, critical infrastructure, and government agencies.
The complaint alleges that law enforcement found administrator credentials on Panev's computer for an online repository hosting source code for multiple versions of LockBit's builder tools and StealBit tool used by affiliates for data exfiltration.
Panev allegedly communicated with Dimitry Yuryevich Khoroshev (also known as LockBitSupp), who is identified as a primary administrator for LockBit. Court documents indicate cryptocurrency transfers totaling over $230,000 were made from Khoroshev to Panev between June 2022 and February 2024.
In interviews with Israeli authorities post-arrest, Panev admitted involvement with coding and development work for LockBit and receiving payments consistent with those identified by U.S. authorities.
The investigation into LockBit follows a disruption operation in February 2024 led by international law enforcement partners which significantly impacted the group's operations.
Several other individuals have been charged alongside Panev in connection with LockBit activities across different jurisdictions including Dmitry Yuryevich Khoroshev and others like Mikhail Vasiliev and Ruslan Astamirov who have pleaded guilty.
The U.S. Department of State offers rewards up to $10 million for information leading to arrests or convictions related to key figures within LockBit under its Transnational Organized Crime Rewards Program.
Victims are encouraged to contact law enforcement through designated channels for assistance or updates regarding potential decryption capabilities developed during disruption efforts against LockBit.
The case involves cooperation among numerous international agencies across several countries including Israel's National Police; France’s Cyberspace Command; Europol; UK's National Crime Agency; Germany’s Bundeskriminalamt; Canada's Royal Canadian Mounted Police among others contributing significantly towards this ongoing investigation.
Assistant U.S. Attorneys Andrew M. Trombly et al., along with Trial Attorneys Debra Ireland and Jorge Gonzalez are prosecuting these cases while additional guidance on network protection against such threats can be accessed via StopRansomware.gov.