The U.S. Department of Justice has charged Rostislav Panev, a dual Russian and Israeli national, for his alleged involvement with the LockBit ransomware group. 

Panev, 51, is accused of working as a developer for the group, earning over $230,000 in cryptocurrency for his contributions. Arrested in Israel in August, Panev is currently awaiting extradition to the United States to face charges.

LockBit is a notorious ransomware group known for targeting known for targeting entities worldwide, including major corporations like Boeing, financial institutions such as the Industrial & Commercial Bank of China, and government services like the UK’s Royal Mail, according to Bloomberg.

Ransomware attacks typically involve encrypting victims’ data and demanding cryptocurrency payments to restore access.

Telegram and crypto connections

Panev reportedly communicated with LockBit members using the encrypted messaging app Telegram, widely favored in cybercrime circles for its privacy features. Telegram is often used in the cybercrime world for its privacy features. According to his defense attorney, Sharon Nahari, Panev was a software developer who was unaware of the malicious intent behind the tools he created.

Panev has reportedly cooperated with law enforcement, providing information about his activities.

Authorities allege that his work included developing malware to disable antivirus systems, deploying ransomware, and printing ransom notes across affected networks.

Payments to Panev were allegedly laundered through cryptocurrency mixing services, a common tactic in ransomware operations to obscure transaction trails.

Since its emergence in 2019, LockBit has caused billions of dollars in damages globally. The group has extorted at least $500 million from over 2,500 victims across 120 countries. Its operations rely on developers like Panev to create malware and affiliates to execute attacks.

In February, authorities in the U.S. and U.K. disrupted LockBit’s infrastructure, seizing websites, servers, and decryption keys, which significantly hampered the group’s activities. Despite these efforts, LockBit remains active, with Panev’s arrest marking the latest step in ongoing prosecution efforts.

LockBit’s alleged leader, Dmitry Khoroshev, remains at large. The U.S. government has offered a $10 million reward for information leading to his capture.