The U.S. government has charged a 51-year-old dual citizen of Russia and Israel, Rostislav Panev, with allegedly creating and maintaining the code for LockBit ransomware.
Panev is accused of earning over $230,000 in cryptocurrency for his involvement. He was arrested in Israel and is awaiting extradition to the U.S., making him the third alleged member of the LockBit ransomware group to be taken into custody.
Authorities previously apprehended other suspected members of the group, including Mikhail Vasiliev and Ruslan Magomedovich Astamirov, both of whom have already pleaded guilty to charges such as conspiracy to commit computer fraud.
Meanwhile, law enforcement is still on the hunt for the group’s alleged leader, Dmitry Khoroshev. The U.S. Department of Justice (DOJ) is offering a $10 million reward for information leading to his capture. The DOJ claims that Khoroshev received at least $100 million in cryptocurrency through his share of LockBit ransom payments, which accounted for 20% of the profits extorted by affiliates using the ransomware.
According to court documents, Panev has been linked to LockBit since its formation in 2019. Prosecutors say he played a critical role in developing the ransomware used in attacks against hundreds of targets worldwide, including hospitals, businesses, and government agencies.
Investigators reportedly uncovered login credentials on Panev’s computer for a dark web repository containing multiple versions of the LockBit builder—a tool used to create customized versions of the ransomware for specific victims. Panev allegedly admitted to Israeli authorities that he wrote and maintained parts of the malware code.
The complaint outlines some of the code Panev worked on, which included features to disable Windows Defender, spread malware across multiple devices within a network, and even print ransom notes on every printer connected to a victim’s system. Panev claimed he initially didn’t realize his work was part of illegal activity, according to his statements to the police.
