A dual Russian and Israeli national, aged 51, who is allegedly a key developer of the notorious LockBit ransomware group, has been extradited to the United States, nearly three months after being formally charged in connection with the e-crime scheme.
Rostislav Panev was previously arrested in Israel in August 2024, and is believed to have been working as a developer for the ransomware gang from 2019 to February 2024, when the operation’s online infrastructure was seized in a law enforcement exercise.
United States Attorney John Giordano stated, “Rostislav Panev’s extradition to the District of New Jersey sends a clear message: if you are a member of the LockBit ransomware conspiracy, the United States will find you and bring you to justice.”
LockBit has become one of the most prolific ransomware groups, attacking over 2,500 entities in more than 120 countries worldwide, with nearly 1,800 of those located in the United States.
The group’s victims have included individuals, small businesses, and multinational corporations, such as hospitals, schools, nonprofit organizations, critical infrastructure, and government and law-enforcement agencies.
The cybercrime spree has generated at least $500 million in illicit profits, resulting in billions of dollars in losses for victims in the form of lost revenue and costs from incident response and recovery.
In his role as a LockBit developer, Panev was responsible for designing and maintaining the locker’s codebase, earning approximately $230,000 between June 2022 and February 2024.
According to the Justice Department, Panev admitted to developing code to disable antivirus software, deploy malware to multiple computers connected to a victim network, and print the LockBit ransom note to all printers connected to a victim network.
Additionally, Panev admitted to writing and maintaining LockBit malware code and providing technical guidance to the LockBit group.
Besides Panev, six other LockBit members, including Mikhail Vasiliev, Ruslan Astamirov, Artur Sungatov, Ivan Gennadievich Kondratiev, Mikhail Pavlovich Matveev, and Dmitry Yuryevich Khoroshev, have been charged in the U.S. Khoroshev has also been identified as LockBit’s administrator, operating under the online alias LockBitSupp.
Furthermore, Khoroshev, Matveev, Sungatov, and Kondratyev have been sanctioned by the Department of the Treasury’s Office of Foreign Assets Control (OFAC) for their roles in launching cyber attacks.
