A Russian-Israeli man has been extradited to the US amid accusations of being a key LockBit ransomware developer.
Rostislav Panev, 51, was arrested in Israel last year and has now appeared before magistrate judge André Espinosa.
In a statement confirming Panev’s extradition, John Giordano, US attorney for the District of New Jersey, said the move sends a strong message to cyber criminals.
“If you are a member of the LockBit ransomware conspiracy, the United States will find you and bring you to justice," Giordano said.
"Even as the means and methods of cyber criminals become more sophisticated, my Office and our FBI, Criminal Division, and international law enforcement partners are more committed than ever to prosecuting these criminals."
LockBit was one of the most notorious ransomware groups in the world, attacking more than 2,500 victims in at least 120 countries. Victims included multinational corporations, as well as hospitals, schools, non-profit organizations, critical infrastructure and government, and law-enforcement agencies.
The group is believed to have netted at least $500 million in ransom payments over the years.
Panev is said to have worked as a developer for the group right from the start until it was disrupted in February 2024 by the UK's National Crime Agency (NCA).
When he was arrested, law enforcement discovered administrator credentials for an online repository on Panev’s computer. Hosted on the dark web, this stored source code for multiple versions of the LockBit builder, designed to help affiliates generate custom builds of the ransomware malware tailored for particular victims.
Authorities also unearthed source code for LockBit’s StealBit tool, which helped affiliates exfiltrate stolen data, along with access credentials for the LockBit online dashboard control panel.
The complaint alleges that Panev exchanged direct messages through a cyber criminal forum with LockBit’s primary administrator, discussing work that needed to be done on the group’s builder and control panel.
RELATED WHITEPAPER
Between June 2022 and February 2024, this administrator made a series of cryptocurrency transfers to a wallet owned by Panev, amounting to more than $230,000.
According to the US Justice Department, when interviewed by Israeli authorities Panev admitted to having carried out coding, development, and consulting work for the LockBit group and to having received regular cryptocurrency payments.
Panev said he'd worked on the development of code to disable antivirus software; to deploy malware to multiple computers connected to a victim network; and to print the LockBit ransom note to all printers connected to a victim network.
He also admitted to having written and maintained LockBit malware code, and to having provided technical guidance to the LockBit group.
"No one is safe from ransomware attacks, from individuals to institutions," said acting special agent in charge of the FBI Newark Division, Terence G. Reilly.
"Along with our international partners, the FBI continues to leave no stone unturned when it comes to following LockBit's trail of destruction. We will continue to work tirelessly to prevent actors, such as Panev, from hacking their way to financial gain."
MORE FROM ITPRO
- February was the worst month on record for ransomware attacks
- Warning issues over prolific 'Ghost' ransomware group
- The new ransomware groups worrying experts in 2025
-
European financial firms are battling a huge rise in third-party breachesNews Growing vendor dependency has contributed to a marked rise in third-party breaches
-
‘We’ve got some fabulous conditions’: Salesforce UK chief exec Zahra Bahrololoumi touts the country's tech industry potentialNews The UK remains a “priority market” for Salesforce, according to its regional CEO
-
‘I take pleasure in thinking I can rid society of at least some of them’: A cyber vigilante is dumping information on notorious ransomware criminals – and security experts say police will be keeping close tabsNews An anonymous whistleblower has released large amounts of data allegedly linked to the ransomware gangs
-
It's been a bad week for ransomware operatorsNews A host of ransomware strains have been neutralized, servers seized, and key players indicted
-
Everything we know about the Peter Green Chilled cyber attackNews A ransomware attack on the chilled food distributor highlights the supply chain risks within the retail sector
-
Scattered Spider: Who are the alleged hackers behind the M&S cyber attack?News The Scattered Spider group has been highly active in recent years
-
Ransomware attacks are rising — but quiet payouts could mean there's more than actually reported
News Ransomware attacks continue to climb, but they may be even higher than official figures show as companies choose to quietly pay to make such incidents go away.
-
Cleo attack victim list grows as Hertz confirms customer data stolen – and security experts say it won't be the lastNews Hertz has confirmed it suffered a data breach as a result of the Cleo zero-day vulnerability in late 2024, with the car rental giant warning that customer data was stolen.
-
‘Phishing kits are a force multiplier': Cheap cyber crime kits can be bought on the dark web for less than $25 – and experts warn it’s lowering the barrier of entry for amateur hackersNews Research from NordVPN shows phishing kits are now widely available on the dark web and via messaging apps like Telegram, and are often selling for less than $25.
-
Healthcare systems are rife with exploits — and ransomware gangs have noticedNews Nearly nine-in-ten healthcare organizations have medical devices that are vulnerable to exploits, and ransomware groups are taking notice.
