Alleged LockBit developer extradited to the US
Rostislav Panev has allegedly admitted having carried out coding, development and consulting work for the group.
A Russian-Israeli man has been extradited to the US amid accusations of being a key LockBit ransomware developer.
Rostislav Panev, 51, was arrested in Israel last year and has now appeared before magistrate judge André Espinosa.
In a statement confirming Panev’s extradition, John Giordano, US attorney for the District of New Jersey, said the move sends a strong message to cyber criminals.
“If you are a member of the LockBit ransomware conspiracy, the United States will find you and bring you to justice," Giordano said.
"Even as the means and methods of cyber criminals become more sophisticated, my Office and our FBI, Criminal Division, and international law enforcement partners are more committed than ever to prosecuting these criminals."
LockBit was one of the most notorious ransomware groups in the world, attacking more than 2,500 victims in at least 120 countries. Victims included multinational corporations, as well as hospitals, schools, non-profit organizations, critical infrastructure and government, and law-enforcement agencies.
The group is believed to have netted at least $500 million in ransom payments over the years.
Panev is said to have worked as a developer for the group right from the start until it was disrupted in February 2024 by the UK's National Crime Agency (NCA).
When he was arrested, law enforcement discovered administrator credentials for an online repository on Panev’s computer. Hosted on the dark web, this stored source code for multiple versions of the LockBit builder, designed to help affiliates generate custom builds of the ransomware malware tailored for particular victims.
Authorities also unearthed source code for LockBit’s StealBit tool, which helped affiliates exfiltrate stolen data, along with access credentials for the LockBit online dashboard control panel.
The complaint alleges that Panev exchanged direct messages through a cyber criminal forum with LockBit’s primary administrator, discussing work that needed to be done on the group’s builder and control panel.
RELATED WHITEPAPER
Between June 2022 and February 2024, this administrator made a series of cryptocurrency transfers to a wallet owned by Panev, amounting to more than $230,000.
According to the US Justice Department, when interviewed by Israeli authorities Panev admitted to having carried out coding, development, and consulting work for the LockBit group and to having received regular cryptocurrency payments.
Panev said he'd worked on the development of code to disable antivirus software; to deploy malware to multiple computers connected to a victim network; and to print the LockBit ransom note to all printers connected to a victim network.
He also admitted to having written and maintained LockBit malware code, and to having provided technical guidance to the LockBit group.
"No one is safe from ransomware attacks, from individuals to institutions," said acting special agent in charge of the FBI Newark Division, Terence G. Reilly.
"Along with our international partners, the FBI continues to leave no stone unturned when it comes to following LockBit's trail of destruction. We will continue to work tirelessly to prevent actors, such as Panev, from hacking their way to financial gain."
MORE FROM ITPRO
- February was the worst month on record for ransomware attacks
- Warning issues over prolific 'Ghost' ransomware group
- The new ransomware groups worrying experts in 2025
-
Ransomware cartels are fragmenting into volatile splinter groups, warns Met Police cyber chiefNews Commoditized "cyber crime bazaars" and AI data mining are forcing law enforcement to rewrite its playbook
-
New ransomware threat group, The Gentlemen, has become one of the most active ransomware operators, accounting for 10% of all attacksNews NTT researchers warn that the RaaS group is leveraging SystemBC malware to establish covert tunnelling, evade detection, and support rapid lateral movement across enterprise environments
-
Instructure chose to a pay ransom following the Canvas cyber attack – research shows more than half of security leaders would follow suitAnalysis Opting to pay ransoms creates huge risks for enterprises – you’re relying on the word of criminals
-
Ransomware negotiator sentenced for role in major cyber crime groupNews Deniss Zolotarjovs was a key player in a group associated with Conti
-
Threat actors ditch ‘spray and pray’ attacks in shift to targeted exploitationNews A dip in ransomware volumes points to a more targeted approach focused on vulnerability exploitation
-
Security leaders overconfident about ransomware recovery
News Few manage to recover all their data, and many experience business disruption
-
German authorities want your help finding the hackers behind GandCrab and REvilNews Daniil Maksimovich Shchukin and Anatoly Sergeevitsch Kravchuk are believed to have made millions from ransomware as a service schemes
-
The rise of teen hackers ‘makes for a good headline’, but cyber crime activities peak later in life
News With family responsibilities and mortgages to pay, it's not teenagers dishing out malware or carrying out cyber extortion
