A Russian-Israeli man has been extradited to the US amid accusations of being a key LockBit ransomware developer.
Rostislav Panev, 51, was arrested in Israel last year and has now appeared before magistrate judge André Espinosa.
In a statement confirming Panev’s extradition, John Giordano, US attorney for the District of New Jersey, said the move sends a strong message to cyber criminals.
“If you are a member of the LockBit ransomware conspiracy, the United States will find you and bring you to justice," Giordano said.
"Even as the means and methods of cyber criminals become more sophisticated, my Office and our FBI, Criminal Division, and international law enforcement partners are more committed than ever to prosecuting these criminals."
LockBit was one of the most notorious ransomware groups in the world, attacking more than 2,500 victims in at least 120 countries. Victims included multinational corporations, as well as hospitals, schools, non-profit organizations, critical infrastructure and government, and law-enforcement agencies.
The group is believed to have netted at least $500 million in ransom payments over the years.
Panev is said to have worked as a developer for the group right from the start until it was disrupted in February 2024 by the UK's National Crime Agency (NCA).
When he was arrested, law enforcement discovered administrator credentials for an online repository on Panev’s computer. Hosted on the dark web, this stored source code for multiple versions of the LockBit builder, designed to help affiliates generate custom builds of the ransomware malware tailored for particular victims.
Authorities also unearthed source code for LockBit’s StealBit tool, which helped affiliates exfiltrate stolen data, along with access credentials for the LockBit online dashboard control panel.
The complaint alleges that Panev exchanged direct messages through a cyber criminal forum with LockBit’s primary administrator, discussing work that needed to be done on the group’s builder and control panel.
RELATED WHITEPAPER
Between June 2022 and February 2024, this administrator made a series of cryptocurrency transfers to a wallet owned by Panev, amounting to more than $230,000.
According to the US Justice Department, when interviewed by Israeli authorities Panev admitted to having carried out coding, development, and consulting work for the LockBit group and to having received regular cryptocurrency payments.
Panev said he'd worked on the development of code to disable antivirus software; to deploy malware to multiple computers connected to a victim network; and to print the LockBit ransom note to all printers connected to a victim network.
He also admitted to having written and maintained LockBit malware code, and to having provided technical guidance to the LockBit group.
"No one is safe from ransomware attacks, from individuals to institutions," said acting special agent in charge of the FBI Newark Division, Terence G. Reilly.
"Along with our international partners, the FBI continues to leave no stone unturned when it comes to following LockBit's trail of destruction. We will continue to work tirelessly to prevent actors, such as Panev, from hacking their way to financial gain."
MORE FROM ITPRO
- February was the worst month on record for ransomware attacks
- Warning issues over prolific 'Ghost' ransomware group
- The new ransomware groups worrying experts in 2025
-
What is polymorphic malware?Explainer Polymorphic malware constantly changes its code to avoid detection, making it a top cybersecurity threat that demands advanced, behavior-based defenses
-
Outgoing Kaseya CEO teases "this is just the beginning" for the companyOpinion We spoke to Fred Voccola who remains a key figurehead at the firm as it enters its next chapter...
-
Ransomware attacks are rising — but quiet payouts could mean there's more than actually reportedNews Ransomware attacks continue to climb, but they may be even higher than official figures show as companies choose to quietly pay to make such incidents go away.
-
Cleo attack victim list grows as Hertz confirms customer data stolen – and security experts say it won't be the lastNews Hertz has confirmed it suffered a data breach as a result of the Cleo zero-day vulnerability in late 2024, with the car rental giant warning that customer data was stolen.
-
‘Phishing kits are a force multiplier': Cheap cyber crime kits can be bought on the dark web for less than $25 – and experts warn it’s lowering the barrier of entry for amateur hackersNews Research from NordVPN shows phishing kits are now widely available on the dark web and via messaging apps like Telegram, and are often selling for less than $25.
-
Healthcare systems are rife with exploits — and ransomware gangs have noticedNews Nearly nine-in-ten healthcare organizations have medical devices that are vulnerable to exploits, and ransomware groups are taking notice.
-
February was the worst month on record for ransomware attacks – and one threat group had a field day
News February 2025 was the worst month on record for the number of ransomware attacks, according to new research from Bitdefender.
-
CISA issues warning over Medusa ransomware after 300 victims from critical sectors impactedNews The Medusa ransomware as a Service operation compromised twice as many organizations at the start of 2025 compared to 2024
-
Warning issued over prolific 'Ghost' ransomware groupNews The Ghost ransomware group is known to act fast and exploit vulnerabilities in public-facing appliances
-
The Zservers takedown is another big win for law enforcementNews LockBit has been dealt another blow by law enforcement after Dutch police took 127 of its servers offline
