Update (1035 EST): The U.S. Department of Justice has formally charged Mr. Khoroshev. The announcement reads below:
“Dimitry Yuryevich Khoroshev, also known as LockBitSupp, LockBit, and putinkrab, 31, of Voronezh, Russia, is charged by a 26-count indictment returned by a grand jury in the District of New Jersey…Khoroshev is charged with one count of conspiracy to commit fraud, extortion, and related activity in connection with computers; one count of conspiracy to commit wire fraud; eight counts of intentional damage to a protected computer; eight counts of extortion in relation to confidential information from a protected computer; and eight counts of extortion in relation to damage to a protected computer. In total, those charges carry a maximum penalty of 185 years in prison. Each of the 26 counts charged by the indictment also carries a maximum fine of the greatest of $250,000, pecuniary gain to the offender, or pecuniary harm to the victim.”
LockBit 3.0 Unmasked
The United States Treasury has announced that Dmitry Yuryevich Khoroshev, a Russian national, is the leader of LockBit 3.0 ransomware group and has sanctioned him. The announcement reads below:
“Today, the United States designated Dmitry Yuryevich Khoroshev, a Russian national and a leader of the Russia-based LockBit group, for his role in developing and distributing LockBit ransomware. This designation is the result of a collaborative effort with the U.S. Department of Justice, Federal Bureau of Investigation, the UK’s National Crime Agency and other international partners. Today, the Department of Justice is unsealing an indictment and the United Kingdom and Australia are also announcing the designation of Khoroshev.”
This announcement was mirrored by the United Kingdom National Crime Agency and the Australian government. The announcement from the NCA reads below:
“A leader of what was once the world’s most harmful cyber crime group has been unmasked and sanctioned by the UK, US and Australia, following a National Crime Agency-led international disruption campaign. The sanctions against Russian national Dmitry Khoroshev (pictured), the administrator and developer of the LockBit ransomware group, are being announced today by the FCDO alongside the US Department of the Treasury’s Office of Foreign Assets Control (OFAC) and the Australian Department of Foreign Affairs.”
This announcement comes after the group published a large flow of documents from dozens of companies on its dark web portal in the last twenty-four hours, presumably in anticipation of the unmasking.
At approximately 0250 EST on May 6th, 2024, LockBit 3.0 published on its dark web portal that the UK NCA, Europol, and the US DOJ would publish an announcement concerning the group. Over the next twenty-four hours, the group published documents of 43 companies.
#LockBit: 43 new victims in less than 24 hours
While we wait for the National Crime Agency (@NCA_UK) to potentially reveal new information, in less than 24 hours, LockBit has posted 43 new victims on its data leak site.
All the details coming soon in our Hacks of Today.… pic.twitter.com/XxtFJR58QU
— HackManac (@H4ckManac) May 7, 2024
First Public Downfall
This is the first instance of such a dramatic unmasking of a criminal ransomware group. This unmasking was reportedly made possible by the seizure of a physical leak site of the group in an unnamed country.
According to the U.S. Treasury the Russia-based LockBit ransomware group is one of the most active ransomware groups in the world and is best known for its ransomware variant of the same name. It has targeted over 2,500 victims worldwide and is alleged to have received more than $500 million in ransom payments. Since January 2020, affiliates using LockBit have attacked organizations across an array of critical infrastructure sectors, including financial services, food and agriculture, education, emergency services, and healthcare.
