A Russian-Israeli man has been extradited to the US amid accusations of being a key LockBit ransomware developer.
Rostislav Panev, 51, was arrested in Israel last year and has now appeared before magistrate judge André Espinosa.
In a statement confirming Panev’s extradition, John Giordano, US attorney for the District of New Jersey, said the move sends a strong message to cyber criminals.
“If you are a member of the LockBit ransomware conspiracy, the United States will find you and bring you to justice," Giordano said.
"Even as the means and methods of cyber criminals become more sophisticated, my Office and our FBI, Criminal Division, and international law enforcement partners are more committed than ever to prosecuting these criminals."
LockBit was one of the most notorious ransomware groups in the world, attacking more than 2,500 victims in at least 120 countries. Victims included multinational corporations, as well as hospitals, schools, non-profit organizations, critical infrastructure and government, and law-enforcement agencies.
The group is believed to have netted at least $500 million in ransom payments over the years.
Panev is said to have worked as a developer for the group right from the start until it was disrupted in February 2024 by the UK's National Crime Agency (NCA).
When he was arrested, law enforcement discovered administrator credentials for an online repository on Panev’s computer. Hosted on the dark web, this stored source code for multiple versions of the LockBit builder, designed to help affiliates generate custom builds of the ransomware malware tailored for particular victims.
Authorities also unearthed source code for LockBit’s StealBit tool, which helped affiliates exfiltrate stolen data, along with access credentials for the LockBit online dashboard control panel.
The complaint alleges that Panev exchanged direct messages through a cyber criminal forum with LockBit’s primary administrator, discussing work that needed to be done on the group’s builder and control panel.
RELATED WHITEPAPER
Between June 2022 and February 2024, this administrator made a series of cryptocurrency transfers to a wallet owned by Panev, amounting to more than $230,000.
According to the US Justice Department, when interviewed by Israeli authorities Panev admitted to having carried out coding, development, and consulting work for the LockBit group and to having received regular cryptocurrency payments.
Panev said he'd worked on the development of code to disable antivirus software; to deploy malware to multiple computers connected to a victim network; and to print the LockBit ransom note to all printers connected to a victim network.
He also admitted to having written and maintained LockBit malware code, and to having provided technical guidance to the LockBit group.
"No one is safe from ransomware attacks, from individuals to institutions," said acting special agent in charge of the FBI Newark Division, Terence G. Reilly.
"Along with our international partners, the FBI continues to leave no stone unturned when it comes to following LockBit's trail of destruction. We will continue to work tirelessly to prevent actors, such as Panev, from hacking their way to financial gain."
MORE FROM ITPRO
- February was the worst month on record for ransomware attacks
- Warning issues over prolific 'Ghost' ransomware group
- The new ransomware groups worrying experts in 2025
-
Bigger salaries, more burnout: Is the CISO role in crisis?In-depth CISOs are more stressed than ever before – but why is this and what can be done?
-
Cheap cyber crime kits can be bought on the dark web for less than $25News Research from NordVPN shows phishing kits are now widely available on the dark web and via messaging apps like Telegram, and are often selling for less than $25.
-
‘Phishing kits are a force multiplier': Cheap cyber crime kits can be bought on the dark web for less than $25 – and experts warn it’s lowering the barrier of entry for amateur hackers
News Research from NordVPN shows phishing kits are now widely available on the dark web and via messaging apps like Telegram, and are often selling for less than $25.
-
Healthcare systems are rife with exploits — and ransomware gangs have noticedNews Nearly nine-in-ten healthcare organizations have medical devices that are vulnerable to exploits, and ransomware groups are taking notice.
-
February was the worst month on record for ransomware attacks – and one threat group had a field dayNews February 2025 was the worst month on record for the number of ransomware attacks, according to new research from Bitdefender.
-
CISA issues warning over Medusa ransomware after 300 victims from critical sectors impactedNews The Medusa ransomware as a Service operation compromised twice as many organizations at the start of 2025 compared to 2024
-
Warning issued over prolific 'Ghost' ransomware groupNews The Ghost ransomware group is known to act fast and exploit vulnerabilities in public-facing appliances
-
The Zservers takedown is another big win for law enforcementNews LockBit has been dealt another blow by law enforcement after Dutch police took 127 of its servers offline
-
There’s a new ransomware player on the scene: the ‘BlackLock’ group has become one of the most prolific operators in the cyber crime industry – and researchers warn it’s only going to get worse for potential victimsNews Security experts have warned the BlackLock group could become the most active ransomware operator in 2025
-
Ransomware missteps that can cost youWhitepaper Agile risk management starts with a common language
