<p>The U.S. charged Israeli-Russian national Rostislav Panev with developing software for the infamous LockBit ransomware group that for years has caught the attention of law enforcement officials and cybersecurity researchers around the world.</p>
Introduction to Malware Binary Triage (IMBT) Course
Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.
Enroll Now and Save 10%: Coupon Code MWNEWS10
Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.
<p>Panev allegedly served as a developer for the LockBit ransomware group from its formation around 2019 until at least February 2024. During that period, he and associates expanded LockBit into one of the most active and destructive ransomware organizations globally. </p>
<p>The group targeted over 2,500 victims across at least 120 countries, including 1,800 in the United States, the Justice Department said in a <a href=“Office of Public Affairs | United States Charges Dual Russian and Israeli National as Developer of LockBit Ransomware Group | United States Department of Justice”>media release</a> announcing the charges.</p>
<p>Their victims ranged from individuals and small businesses to large corporations, hospitals, schools, nonprofit organizations, critical infrastructure, government and law enforcement entities. LockBit’s operations resulted in the extraction of over $500 million in ransom payments and caused billions of dollars in additional losses, DOJ said.</p>
<p>The U.S. is <a href=“Israeli hacker faces extradition to U.S. for role in global ransomware network”>seeking extradition</a> of Panev from Israel, according to a Thursday report from Israeli news outlet Ynet. Panev was arrested in August.</p>
<p>“My client is a computer technician,” Panev’s lawyer, Sharon Nahari, said in a statement to Ynet. “His role was strictly limited to software development, and he was neither aware of nor involved in the primary offenses he has been accused of, including fraud, extortion, and money laundering.”</p>
<p>During Panev’s arrest, law enforcement found administrator credentials on his computer for a dark web repository containing LockBit ransomware source code, including tools for customizing attacks and stealing data, <a href=“https://www.justice.gov/opa/media/1381806/dl”>legal documents</a> said. They also uncovered credentials for the LockBit control panel, used by affiliate groups to manage operations.</p>
<p>Panev admitted to Israeli authorities that he had performed coding, development and consulting work for the LockBit group, receiving regular cryptocurrency payments, the DOJ said. He acknowledged creating code to disable antivirus software, spread malware across victim networks and print ransom notes on all connected printers. Panev also admitted to writing and maintaining LockBit malware code and offering technical support to the group.</p>
<p>LockBit first emerged in 2020 and caught the attention of the Cybersecurity and Infrastructure Security Agency and its international counterparts, becoming a major global ransomware operation that held organizations’ sensitive data hostage in exchange for a ransom payment. In 2022, CISA deemed it the most active ransomware collective in the world. </p>
<p>Much of the group’s core infrastructure was <a href=“US, international partners disrupt LockBit ransomware operations - Nextgov/FCW”>taken down</a> by the FBI and international partners during an operation announced in February. But some of its servers <a href=“LockBit ransomware returns, restores servers after police disruption”>relaunched</a> soon after.</p>
<p>LockBit, whose members are generally Russian-speaking and are believed to be <a href=“Office of Public Affairs | U.S. Charges Russian National with Developing and Operating LockBit Ransomware | United States Department of Justice”>based in Russia</a>, became the subject of a major <a href=“https://www.washingtonpost.com/politics/2023/11/14/did-ransomware-gang-mess-up-by-attacking-us-arm-chinas-biggest-bank/”>ransomware attack</a> on the Chinese government-owned Industrial Commercial Bank of China in November.</p>
Article Link: US charges Israeli-Russian national with making software for LockBit ransomware gang - Nextgov/FCW