- Russian national Dmitry Yuryevich Khoroshev was indicted in New Jersey federal court with more than two dozen crimes related to his executive role in the LockBit ransomware group.
- A $10 million reward for Khoroshev's arrest was posted by the U.S. State Department.
- The DOJ said the Lockbit group at times was "the most prolific ransomware group in the world," targeting more than 2,000 victims and stealing more than $500 million in payments.
- Victims included individuals, small businesses, multinational corporations, hospitals, schools, nonprofit organizations, critical infrastructure and government and law enforcement agencies.
Federal prosecutors on Tuesday announced criminal charges against a Russian national, Dmitry Yuryevich Khoroshev, for allegedly creating, developing and administrating the LockBit ransomware-as-a-service group.
The U.S. State Department at the same time offered a $10 million reward for information leading to the apprehension and arrest of Khoroshev, a 31-year-old from Voronezh, Russia.
The Treasury Department also imposed sanctions on Khoroshev, blocking all property and interests he holds in the U.S. or are in the possession of Americans.
The Department of Justice said the LockBit group led by Khoroshev at times was "the most prolific ransomware group in the world," targeting more than 2,000 victims, most of them in the U.S., stealing more than $500 million in ransomware payments, and causing billions of dollars more in broader losses including lost revenue.
LockBit's ransomware-as-a-service model licensed its software to other cybercriminals in exchange for payments that included a percentage of ransoms paid by victims, which included "individuals, small businesses, multinational corporations, hospitals, schools, nonprofit organizations, critical infrastructure, and government and law-enforcement agencies," according to the DOJ.
Khoroshev, who also is known as LockBitSupp, LockBit and putinkrab, was charged in a 26-count indictment in U.S. District Court in New Jersey, which accuses him of personally pocketing at least $100 million from victims of the group. He typically received 20% of each ransom payment, authorities said.
Money Report
The charges, unsealed Tuesday, come three months after law enforcement in the U.K., working with the DOJ, FBI and other international agencies, seized public websites used by LockBit, and seized control of servers used by administrators for the group.
Feeling out of the loop? We'll catch you up on the Chicago news you need to know. Sign up for the weekly Chicago Catch-Up newsletter.
The DOJ said LockBit infrastructure seized by law enforcement in February showed "that Khoroshev retained copies of data stolen from LockBit victims who had paid the demanded ransom."
Khoroshev is the sixth LockBit member charged with crimes related to the group. One of them, Ruslan Magomedovich Astamirov, is in custody awaiting trial in New Jersey federal court, while another, Mikhail Vasiliev, is in custody in Canada awaiting extradition to the U.S.
Khoroshev is charged with conspiracy to commit fraud, extortion and related activity in connection with computers; conspiracy to commit wire fraud; intentional damage to a protected computer; extortion in relation to confidential information from a protected computer; and extortion in relation to damage to a protected computer.
He faces a maximum possible sentence of 185 years in prison if convicted.
"The LockBit ransomware group represented one of the most prolific ransomware variants across the globe, causing billions of dollars in losses and wreaking havoc on critical infrastructure, including schools and hospitals," said FBI Director Christopher Wray in a statement.