A criminal complaint filed Dec. 20 in the District of New Jersey charged dual Russian and Israeli national Rostislav Panev for his role as developer of the LockBit ransomware group.
In August 2024, Panev was arrested in Israel pursuant to a U.S. provisional arrest request with a view towards extradition to the United States. He is currently in custody in Israel pending extradition on the charges in the superseding complaint. The LockBit group attacked more than 2,500 victims in at least 120 countries around the world between 2019 and 2024.
“The Justice Department’s work going after the world’s most dangerous ransomware schemes includes not only dismantling networks, but also finding and bringing to justice the individuals responsible for building and running them,” Attorney General Merrick Garland said in a public statement released by the Department of Justice. “Three of the individuals who we allege are responsible for LockBit’s cyberattacks against thousands of victims are now in custody, and we will continue to work alongside our partners to hold accountable all those who lead and enable ransomware attacks.”
According to Principal Deputy Assistant Attorney General Nicole Argentieri, head of the Justice Department’s Criminal Division, Panev’s arrest and prosecution is part of a larger investigation into LockBit’s activities. Charges have also been brought against seven of the group’s key members, including affiliates, developers, and its administrator. Three of these defendants have been arrested, including Panev.
“The criminal complaint alleges that Rostislav Panev developed malware and maintained the infrastructure for LockBit, which was once the world’s most destructive ransomware group and attacked thousands of victims, causing billions of dollars in damage,” Argentieri said.
“The LockBit group has targeted both public and private sector victims around the world, including schools, hospitals, and critical infrastructure, as well as small businesses and multi-national corporations,” added FBI Director Christopher Wray. “No matter how hidden or advanced the threat, the FBI remains committed to working with our interagency partners to safeguard the cyber ecosystem and hold accountable those who are responsible for these criminal activities.”
According to the superseding complaint, documents filed in this and related cases, and statements made in court, Panev acted as a developer of the LockBit ransomware group from its inception in or around 2019 through at least February 2024. During that time, Panev and his LockBit coconspirators grew LockBit into what was, at times, the most active and destructive ransomware group in the world. The LockBit group attacked more than 2,500 victims in at least 120 countries around the world, including 1,800 in the United States.
Their victims ranged from individuals and small businesses to multinational corporations, including hospitals, schools, nonprofit organizations, critical infrastructure, and government and law-enforcement agencies. LockBit’s members extracted at least $500 million in ransom payments from their victims and caused billions of dollars in other losses, including lost revenue and costs from incident response and recovery.
LockBit’s members included “developers” like Panev, who designed the LockBit malware code and maintained the infrastructure on which LockBit operated. LockBit’s other members, called “affiliates,” carried out LockBit attacks and extorted ransom payments from LockBit victims.
The U.S. Department of State’s TOC Rewards Program is offering rewards of up to $10 million for information leading to the arrest and/or conviction of Panev’s co-conspirators that remain at large. Information is accepted through the FBI tip website at tips.fbi.gov.
LockBit victims are encouraged to contact the FBI and submit information at www.ic3.gov/ and visit www.justice.gov/usao-nj/lockbit for case updates and information regarding their rights under U.S. law, including the right to submit victim impact statements and request restitution, in the criminal litigation against Panev and his partners.