The Department of Justice has unsealed charges against a Russian national accused of developing and administrating LockBit ransomware. In a filing on Tuesday, the DOJ claims the 31-year-old Dmitry Yuryevich Khoroshev helped make LockBit one of “the most prolific and destructive ransomware group[s] in the world.”
Khoroshev has allegedly had involvement in LockBit since it first emerged in September 2019. Over the years, LockBit ransomware attacks have claimed over 2,500 victims in at least 120 countries, with Khoroshev and other co-conspirators allegedly collecting at least $500 million in ransom payments.
/cdn.vox-cdn.com/uploads/chorus_asset/file/25437904/seized_lockbit_site.png)
Image: UK National Crime Agency
LockBit operates using a ransomware-as-a-service model, allowing bad actors to purchase or rent ransomware to deploy it against victims. The ransomware has been linked to the high-profile attacks on the UK’s Royal Mail service, a children’s hospital, and the small Canadian town of St. Marys, Ontario.
In February, US and UK law enforcement seized the websites and servers used by LockBit and even obtained the keys they could use to help organizations regain access to their data. At the time, it also charged Artur Sungatov and Ivan Kondratyev with deploying LockBit against victims in the US.
Khoroshev allegedly took 20 percent of each ransom payment extorted from victims and also operated the group’s data leak site. Law enforcement found that Khoroshev kept victims’ stolen data even after the group “falsely promised” it would delete the information when receiving a payment.
“Today’s indictment marks a significant milestone in the investigation and prosecution of LockBit, which has already led to charges against five other LockBit affiliates — two of whom are in custody awaiting trial — and a major disruption of the now discredited LockBit operation,” US Attorney Philip R. Sellinger for the District of New Jersey says in a statement.
Khoroshev faces 26 charges — including one count of conspiracy to commit fraud and eight counts of extortion to damage to a protected computer — and up to 185 years in prison. In addition to sanctioning Khoroshev, the feds are offering a $10 million reward for information that helps law enforcement apprehend him.