Israeli National charged by the US DOJ for collaborating with LockBit hackers

The US Department of Justice (DOJ) has charged a 51-year-old Russian-Israeli dual citizen, Rostislav Panev, over his alleged involvement with LockBit, the notorious ransomware group. The DOJ is currently seeking his extradition from Israel, where he was arrested. 

Panev was arrested in August following two guilty pleas in July from two Russian members of the group; Ruslan Astamirov and Mikhail Vasiliev. The LockBit gang, according to the US Department of Justice, has hit over 2500 victims in 120 countries around the world. These include small businesses, large multinationals, hospitals, schools, critical infrastructure, and government and law enforcement agencies. 

Notable victims of LockBit include Boeing Co., The Industrial & Commercial Bank of China, and the UK’s Royal Mail. The group has been connected to a string of ransomware attacks, with victims’ data locked up or their systems rendered inoperable until they extort a fee from them. 

LockBit developer arrested 

Rostilav Panev worked as a developer and coder for LockBit for approximately five years starting from its inception in 2019 to February 2024. The now-detained developer received approximately $230,000 in cryptocurrency transfers as payment for his work, according to the charges filed by the Department of Justice. LockBit and its affiliates extorted at least $500M in payments from victims and also caused significant losses in revenue. 

According to Panev’s lawyer, defense attorney Sharon Nahari, he developed tools for the group without any knowledge of the intended use of the software. The superseding complaint received by the DOJ alleges that Panev exchanged direct messages through a cybercriminal forum with LockBit’s primary administrator. 

His attorney, Sharon Nahari, maintains that Panev corresponded with the group solely through Telegram messages and had no idea about their identity.

“The arrest of Mr. Panev reflects the Department’s commitment to using all its tools to combat the ransomware threat,” said Deputy Attorney General Lisa Monaco. 

Attorney General Merrick B. Garland also stated that three individuals allegedly responsible for the cyber attacks against thousands of victims are in custody and that the Justice Department will continue to hold all those who enable ransomware attacks accountable. 

Law enforcement crackdown

The LockBit group emerged in 2019. The group was discovered in 2020 when its malicious software was discovered on a Russian cybercrimes forum. 

In February, law enforcement in the UK and the US seized websites and servers used by LockBit members and associates. The police also obtained victim data and thousands of decryption keys urging victims to reach out to the group for help in recovering their stolen data. 

LockBit quickly resurfaced after the seizure, stating threateningly, “I cannot be stopped.” 

Despite their bold stance, the efforts of law enforcement have significantly weakened the group’s ability.