Leader of world’s ‘most prolific ransomware group’ charged in Lockbit case — $10 million reward for his arrest

Federal
prosecutors
on
Tuesday
announced
criminal
charges
against
a

Russian
national,
Dmitry
Yuryevich
Khoroshev,
for
allegedly
creating,
developing
and
administrating
the

LockBit
ransomware-as-a-service
group.

The
U.S.
State
Department
at
the
same
time
offered
a

$10
million
reward
for
information
leading
to
the
apprehension
and
arrest
of
Khoroshev,
a
31-year-old
from
Voronezh,
Russia.

The

Treasury
Department
also
imposed
sanctions
on
Khoroshev,
blocking
all
property
and
interests
he
holds
in
the
U.S.
or
are
in
the
possession
of
Americans.

The
Department
of
Justice
said
the
LockBit
group
led
by
Khoroshev
at
times
was “the
most
prolific
ransomware
group
in
the
world,”
targeting
more
than
2,000
victims,
most
of
them
in
the
U.S.,
stealing
more
than
$500
million
in
ransomware
payments,
and
causing
billions
of
dollars
more
in
broader
losses
including
lost
revenue.

LockBit’s
ransomware-as-a-service
model
licensed
its
software
to
other
cybercriminals
in
exchange
for
payments
that
included
a
percentage
of
ransoms
paid
by
victims,
which
included “individuals,
small
businesses,
multinational
corporations,
hospitals,
schools,
nonprofit
organizations,
critical
infrastructure,
and
government
and
law-enforcement
agencies,”
according
to
the
DOJ.

Khoroshev,
who
also
is
known
as
LockBitSupp,
LockBit
and
putinkrab,
was
charged
in
a
26-count
indictment
in
U.S.
District
Court
in
New
Jersey,
which
accuses
him
of
personally
pocketing
at
least
$100
million
from
victims
of
the
group.
He
typically
received
20%
of
each
ransom
payment,
authorities
said.

The
charges,
unsealed
Tuesday,
come
three
months
after

law
enforcement
in
the
U.K.,
working
with
the
DOJ,
FBI
and
other
international
agencies,
seized
public
websites
used
by
LockBit,
and
seized
control
of
servers
used
by
administrators
for
the
group.

The
DOJ
said
LockBit
infrastructure
seized
by
law
enforcement
in
February
showed “that
Khoroshev
retained
copies
of
data
stolen
from
LockBit
victims
who
had
paid
the
demanded
ransom.”

Khoroshev
is
the
sixth
LockBit
member
charged
with
crimes
related
to
the
group.
One
of
them,

Ruslan
Magomedovich
Astamirov,
is
in
custody
awaiting
trial
in
New
Jersey
federal
court,
while
another,

Mikhail
Vasiliev,
is
in
custody
in
Canada
awaiting
extradition
to
the
U.S.

Khoroshev
is
charged
with
conspiracy
to
commit
fraud,
extortion
and
related
activity
in
connection
with
computers;
conspiracy
to
commit
wire
fraud;
intentional
damage
to
a
protected
computer;
extortion
in
relation
to
confidential
information
from
a
protected
computer;
and
extortion
in
relation
to
damage
to
a
protected
computer.

He
faces
a
maximum
possible
sentence
of
185
years
in
prison
if
convicted.

“The
LockBit
ransomware
group
represented
one
of
the
most
prolific
ransomware
variants
across
the
globe,
causing
billions
of
dollars
in
losses
and
wreaking
havoc
on
critical
infrastructure,
including
schools
and
hospitals,”
said
FBI
Director
Christopher
Wray
in
a
statement.