A Russian-Israeli man has been extradited to the US amid accusations of being a key LockBit ransomware developer.
Rostislav Panev, 51, was arrested in Israel last year and has now appeared before magistrate judge André Espinosa.
In a statement confirming Panev’s extradition, John Giordano, US attorney for the District of New Jersey, said the move sends a strong message to cyber criminals.
“If you are a member of the LockBit ransomware conspiracy, the United States will find you and bring you to justice," Giordano said.
"Even as the means and methods of cyber criminals become more sophisticated, my Office and our FBI, Criminal Division, and international law enforcement partners are more committed than ever to prosecuting these criminals."
LockBit was one of the most notorious ransomware groups in the world, attacking more than 2,500 victims in at least 120 countries. Victims included multinational corporations, as well as hospitals, schools, non-profit organizations, critical infrastructure and government, and law-enforcement agencies.
The group is believed to have netted at least $500 million in ransom payments over the years.
Panev is said to have worked as a developer for the group right from the start until it was disrupted in February 2024 by the UK's National Crime Agency (NCA).
When he was arrested, law enforcement discovered administrator credentials for an online repository on Panev’s computer. Hosted on the dark web, this stored source code for multiple versions of the LockBit builder, designed to help affiliates generate custom builds of the ransomware malware tailored for particular victims.
Authorities also unearthed source code for LockBit’s StealBit tool, which helped affiliates exfiltrate stolen data, along with access credentials for the LockBit online dashboard control panel.
The complaint alleges that Panev exchanged direct messages through a cyber criminal forum with LockBit’s primary administrator, discussing work that needed to be done on the group’s builder and control panel.
RELATED WHITEPAPER
Between June 2022 and February 2024, this administrator made a series of cryptocurrency transfers to a wallet owned by Panev, amounting to more than $230,000.
According to the US Justice Department, when interviewed by Israeli authorities Panev admitted to having carried out coding, development, and consulting work for the LockBit group and to having received regular cryptocurrency payments.
Panev said he'd worked on the development of code to disable antivirus software; to deploy malware to multiple computers connected to a victim network; and to print the LockBit ransom note to all printers connected to a victim network.
He also admitted to having written and maintained LockBit malware code, and to having provided technical guidance to the LockBit group.
"No one is safe from ransomware attacks, from individuals to institutions," said acting special agent in charge of the FBI Newark Division, Terence G. Reilly.
"Along with our international partners, the FBI continues to leave no stone unturned when it comes to following LockBit's trail of destruction. We will continue to work tirelessly to prevent actors, such as Panev, from hacking their way to financial gain."
MORE FROM ITPRO
- February was the worst month on record for ransomware attacks
- Warning issues over prolific 'Ghost' ransomware group
- The new ransomware groups worrying experts in 2025
-
Prolific ransomware operator added to Europe’s Most Wanted list as US dangles $10 million rewardNews The US Department of Justice is offering a reward of up to $10 million for information leading to the arrest of Volodymyr Viktorovych Tymoshchuk, an alleged ransomware criminal.
-
Jaguar Land Rover “did the right thing” shutting down systems to thwart cyber attackNews The attack on Jaguar Land Rover highlights the growing attractiveness of the automotive sector
-
Ransomware attack on IT supplier disrupts hundreds of Swedish municipalitiesNews The attack on IT systems supplier Miljödata has impacted public sector services across the country
-
A notorious hacker group is ramping up cloud-based ransomware attacksNews The Storm-0501 threat group is refining its tactics, according to Microsoft, shifting away from traditional endpoint-based attacks and toward cloud-based ransomware.
-
Security researchers have just identified what could be the first ‘AI-powered’ ransomware strain – and it uses OpenAI’s gpt-oss-20b modelNews Using OpenAI's gpt-oss:20b model, ‘PromptLock’ generates malicious Lua scripts via the Ollama API.
-
Data I/O shuts down systems in wake of ransomware attack
News Regulatory filings by Data I/O suggest the costs of dealing with the attack could be significant
-
Average ransom payment doubles in a single quarterNews Targeted social engineering and data exfiltration have become the biggest tactics as three major ransomware groups dominate
-
BlackSuit ransomware gang taken down in latest law enforcement sting – but members have already formed a new groupNews The notorious gang has seen its servers taken down and bitcoin seized, but may have morphed into a new group called Chaos
