Israel, August 2024 – Rostislav Panev, 51, a dual Russian and Israeli national, was arrested in Israel on charges related to his role as a developer for the notorious LockBit ransomware group. The arrest came at the request of U.S. authorities, who have indicted Panev on 41 counts, including computer-related extortion, fraud, and intentional damage to protected computers.
Panev is accused of being a key player in the LockBit ransomware gang, which has been responsible for infecting over 2,500 victims worldwide, causing at least $500 million in extorted ransoms and billions in total damages. From 2019 to 2024, Panev allegedly worked as a developer for the group, helping create and maintain ransomware that was used to encrypt and extort victims.
Authorities claim that after his arrest, Israeli law enforcement found evidence of Panev’s direct involvement in the development of various malware tools, including those used for the LockBit 3.0 ransomware. Among the items discovered on his computer were source codes for multiple ransomware variants and tools for data exfiltration, including a **custom-built version of the Conti ransomware.
U.S. authorities obtained evidence showing that Panev communicated with Dmitry Yuryevich Khoroshev, the alleged leader of LockBit, discussing the development of the ransomware. Khoroshev allegedly paid Panev $10,000 per month for his role in the operation, which included writing code to bypass Windows Defender, deploy malware across networks, and print ransom notes on victim machines.
The indictment unsealed in December 2024 also detailed payments Panev received via cryptocurrency mixing services, indicating a sophisticated money laundering effort by the LockBit group. Despite his claims that he didn’t initially realize the criminal nature of his work, U.S. authorities argue that Panev’s extensive computer science knowledge and experience in cybercrime made it unlikely that he was unaware of the illegal nature of his actions.
The LockBit ransomware group was responsible for disrupting businesses, government agencies, and critical infrastructure globally. While a coordinated disruption led by the UK in early 2024 significantly weakened the gang, authorities remain vigilant as the group’s affiliates continue to cause harm.
Panev’s arrest marks the third LockBit member to be taken into custody as part of an ongoing effort to dismantle the group. Dmitry Khoroshev, the alleged kingpin of LockBit, remains at large with a $10 million bounty on his head.