Ransomware Developer Extradited to US, LockBit Victims Face $500M in Losses

Rostislav Panev, a 51-year-old dual Russian and Israeli national, has been extradited to the United States to face charges related to his alleged involvement with the LockBit ransomware group. Panev was arrested in Israel in August 2023 following a U.S. provisional arrest request and made his first court appearance in the U.S. on March 14, 2025. The charges against him stem from his role as a developer for the LockBit group, which he allegedly joined in 2019 and remained active with until at least February 2024.

The LockBit ransomware group has been notorious for its extensive and sophisticated attacks, targeting over 2,500 victims across 120 countries. Among these victims, 1,800 were located in the U.S., spanning a wide range of entities from individuals and small businesses to multinational corporations, nonprofit organizations, educational institutions, hospitals, and critical infrastructure. The group's activities have resulted in at least $500 million in ransom payments and billions of dollars in losses.

During Panev's arrest, law enforcement discovered his computer administrator credentials, which were linked to an online repository on the Dark Web. This repository contained source code for multiple versions of the LockBit builder, as well as the source code for LockBit's StealBit tool, which affiliates used to exfiltrate stolen data. Panev is alleged to have exchanged messages with Dmitry Yuryevich Khoroshev, the primary administrator of LockBit, discussing the development and control panel of the LockBit builder. Between June 2022 and February 2024, Khoroshev made a series of cryptocurrency transfers to Panev, totaling more than $230,000. Panev admitted to Israeli authorities that he performed coding development and consulting work for the LockBit group, receiving regular payments in cryptocurrency for his services.

The extradition of Panev represents a significant step in the global fight against cybercrime. The U.S. Department of State's Transnational Organized Crime (TOC) Rewards Program has offered a reward of up to $10 million for information leading to the arrest or conviction of Khoroshev and other key members of the LockBit ransomware group. This development highlights the international cooperation and legal measures being implemented to combat the rising threat of ransomware attacks. The extradition process and the subsequent legal proceedings against Panev underscore the complexities involved in prosecuting cybercrime, especially when it involves individuals with dual citizenship and operations that span multiple jurisdictions. The case serves as a stark reminder of the ongoing efforts by law enforcement agencies to dismantle cybercriminal networks and bring those responsible to justice.