MIL Security Engine-1

Note: A copy of the superseding criminal complaint can be found here.

A superseding criminal complaint filed in the District of New Jersey was unsealed today charging a dual Russian and Israeli national for being a developer of the LockBit ransomware group.

In August, Rostislav Panev, 51, a dual Russian and Israeli national, was arrested in Israel pursuant to a U.S. provisional arrest request with a view towards extradition to the United States. Panev is currently in custody in Israel pending extradition on the charges in the superseding complaint.

“The Justice Department’s work going after the world’s most dangerous ransomware schemes includes not only dismantling networks, but also finding and bringing to justice the individuals responsible for building and running them,” said Attorney General Merrick B. Garland. “Three of the individuals who we allege are responsible for LockBit’s cyberattacks against thousands of victims are now in custody, and we will continue to work alongside our partners to hold accountable all those who lead and enable ransomware attacks.”

“The arrest of Mr. Panev reflects the Department’s commitment to using all its tools to combat the ransomware threat,” said Deputy Attorney General Lisa Monaco. “We started this year with a coordinated international disruption of LockBit — the most damaging ransomware group in the world. Fast forward to today and three LockBit actors are in custody thanks to the diligence of our investigators and our strong partnerships around the world. This case is a model for ransomware investigations in the years to come.”

“The arrest of alleged developer Rostislav Panev is part of the FBI’s ongoing efforts to disrupt and dismantle the LockBit ransomware group, one of the most prolific ransomware variants across the globe,” said FBI Director Christopher Wray. “The LockBit group has targeted both public and private sector victims around the world, including schools, hospitals, and critical infrastructure, as well as small businesses and multi-national corporations.  No matter how hidden or advanced the threat, the FBI remains committed to working with our interagency partners to safeguard the cyber ecosystem and hold accountable those who are responsible for these criminal activities.” 

“The criminal complaint alleges that Rostislav Panev developed malware and maintained the infrastructure for LockBit, which was once the world’s most destructive ransomware group and attacked thousands of victims, causing billions of dollars in damage,” said Principal Deputy Assistant Attorney General Nicole M. Argentieri, head of the Justice Department’s Criminal Division. “Along with our domestic and international law enforcement partner actions to dismantle LockBit’s infrastructure, the Criminal Division has disrupted LockBit’s operations by charging seven of its key members (including affiliates, developers, and its administrator) and arresting three of these defendants — including Panev. We are especially grateful for our partnerships with authorities in Europol, the United Kingdom, France, and Israel, which show that, when likeminded countries work together, cybercriminals will find it harder to escape justice.”

“As alleged by the complaint, Rostislav Panev for years built and maintained the digital weapons that enabled his LockBit coconspirators to wreak havoc and cause billions of dollars in damage around the world,” said U.S. Attorney Philip R. Sellinger for the District of New Jersey. “But just like the six other LockBit members previously identified and charged by this office and our FBI and Criminal Division partners, Panev could not remain anonymous and avoid justice indefinitely. He must now answer for his crimes. Today’s announcement represents another blow struck by the United States and our international partners against the LockBit organization, and our efforts will continue relentlessly until the group is fully dismantled and its members brought to justice.”

According to the superseding complaint, documents filed in this and related cases, and statements made in court, Panev acted as a developer of the LockBit ransomware group from its inception in or around 2019 through at least February 2024. During that time, Panev and his LockBit coconspirators grew LockBit into what was, at times, the most active and destructive ransomware group in the world. The LockBit group attacked more than 2,500 victims in at least 120 countries around the world, including 1,800 in the United States. Their victims ranged from individuals and small businesses to multinational corporations, including hospitals, schools, nonprofit organizations, critical infrastructure, and government and law-enforcement agencies. LockBit’s members extracted at least $500 million in ransom payments from their victims and caused billions of dollars in other losses, including lost revenue and costs from incident response and recovery.

LockBit’s members comprised “developers,” like Panev, who designed the LockBit malware code and maintained the infrastructure on which LockBit operated. LockBit’s other members, called “affiliates,” carried out LockBit attacks and extorted ransom payments from LockBit victims. LockBit’s developers and affiliates would then split ransom payments extorted from victims.

As alleged in the superseding complaint, at the time of Panev’s arrest in Israel in August, law enforcement discovered on Panev’s computer administrator credentials for an online repository that was hosted on the dark web and stored source code for multiple versions of the LockBit builder, which allowed LockBit’s affiliates to generate custom builds of the LockBit ransomware malware for particular victims. On that repository, law enforcement also discovered source code for LockBit’s StealBit tool, which helped LockBit affiliates exfiltrate data stolen through LockBit attacks. Law enforcement also discovered access credentials for the LockBit control panel, an online dashboard maintained by LockBit developers for LockBit’s affiliates and hosted by those developers on the dark web.

The superseding complaint also alleges that Panev exchanged direct messages through a cybercriminal forum with LockBit’s primary administrator, who, in an indictment unsealed in the District of New Jersey in May, the United States alleged to be Dimitry Yuryevich Khoroshev (Дмитрий Юрьевич Хорошев), also known as LockBitSupp, LockBit, and putinkrab. In those messages, Panev and the LockBit primary administrator discussed work that needed to be done on the LockBit builder and control panel.

Court documents further indicate that, between June 2022 and February 2024, the primary LockBit administrator made a series of transfers of cryptocurrency, laundered through one or more illicit cryptocurrency mixing services, of approximately $10,000 per month to a cryptocurrency wallet owned by Panev. Those transfers amounted to over $230,000 during that period.

In interviews with Israeli authorities following his arrest in August, Panev admitted to having performed coding, development, and consulting work for the LockBit group and to having received regular payments in cryptocurrency for that work, consistent with the transfers identified by U.S. authorities. Among the work that Panev admitted to having completed for the LockBit group was the development of code to disable antivirus software; to deploy malware to multiple computers connected to a victim network; and to print the LockBit ransom note to all printers connected to a victim network. Panev also admitted to having written and maintained LockBit malware code and to having provided technical guidance to the LockBit group.

The LockBit Investigation

The superseding complaint against, and apprehension of, Panev follows a disruption of LockBit ransomware in February by the United Kingdom (U.K.)’s National Crime Agency (NCA)’s Cyber Division, which worked in cooperation with the Justice Department, FBI, and other international law enforcement partners. As previously announced by the Department, authorities disrupted LockBit by seizing numerous public-facing websites used by LockBit to connect to the organization’s infrastructure and by seizing control of servers used by LockBit administrators, thereby disrupting the ability of LockBit actors to attack and encrypt networks and extort victims by threatening to publish stolen data. That disruption succeeded in greatly diminishing LockBit’s reputation and its ability to attack further victims, as alleged by documents filed in this case.

The superseding complaint against Panev also follows charges brought in the District of New Jersey against other LockBit members, including its alleged primary creator, developer, and administrator, Dmitry Yuryevich Khoroshev. An indictment against Khoroshev unsealed in May alleges that Khoroshev began developing LockBit as early as September 2019, continued acting as the group’s administrator through 2024, a role in which Khoroshev recruited new affiliate members, spoke for the group publicly under the alias “LockBitSupp,” and developed and maintained the infrastructure used by affiliates to deploy LockBit attacks. Khoroshev is currently the subject of a reward of up to $10 million through the U.S. Department of State’s Transnational Organized Crime (TOC) Rewards Program, with information accepted through the FBI tip website at www.tips.fbi.gov/.

A total of seven LockBit members have now been charged in the District of New Jersey. Beyond Panev and Khoroshev, other previously charged LockBit defendants include:

• In July, two LockBit affiliate members, Mikhail Vasiliev, also known as Ghostrider, Free, Digitalocean90, Digitalocean99, Digitalwaters99, and Newwave110, and Ruslan Astamirov, also known as BETTERPAY, offtitan, and Eastfarmer, pleaded guilty in the District of New Jersey for their participation in the LockBit ransomware group and admitted deploying multiple LockBit attacks against U.S. and foreign victims. Vasiliev and Astamirov are presently in custody awaiting sentencing.
• In February, in parallel with the disruption operation described above, an indictment was unsealed in the District of New Jersey charging Russian nationals Artur Sungatov and Ivan Kondratyev, also known as Bassterlord, with deploying LockBit against numerous victims throughout the United States, including businesses nationwide in the manufacturing and other industries, as well as victims around the world in the semiconductor and other industries. Sungatov and Kondratyev remain at large.
• In May 2023, two indictments were unsealed in Washington, D.C., and the District of New Jersey charging Mikhail Matveev, also known as Wazawaka, m1x, Boriselcin, and Uhodiransomwar, with using different ransomware variants, including LockBit, to attack numerous victims throughout the United States, including the Washington, D.C., Metropolitan Police Department. Matveev remains at large and is currently the subject of a reward of up to $10 million through the U.S. Department of State’s TOC Rewards Program, with information accepted through the FBI tip website at www.tips.fbi.gov/.

The U.S. Department of State’s TOC Rewards Program is offering rewards of:

Information is accepted through the FBI tip website at tips.fbi.gov.

Khoroshev, Matveev, Sungatov, and Kondratyev have also been designated for sanctions by the Department of the Treasury’s Office of Foreign Assets Control for their roles in launching cyberattacks.

Victim Assistance

LockBit victims are encouraged to contact the FBI and submit information at www.ic3.gov/. As announced by the Department in February, law enforcement, through its disruption efforts, has developed decryption capabilities that may enable hundreds of victims around the world to restore systems encrypted using the LockBit ransomware variant. Submitting information at the IC3 site will enable law enforcement to determine whether affected systems can be successfully decrypted.

LockBit victims are also encouraged to visit www.justice.gov/usao-nj/lockbit for case updates and information regarding their rights under U.S. law, including the right to submit victim impact statements and request restitution, in the criminal litigation against Panev, Astamirov, and Vasiliev.

The FBI Newark Field Office, under the supervision of Acting Special Agent in Charge Nelson I. Delgado, is investigating the LockBit ransomware variant. Israel’s Office of the State Attorney, Department of International Affairs, and Israel National Police; France’s Gendarmerie Nationale Cyberspace Command, Paris Prosecution Office — Cyber Division, and judicial authorities at the Tribunal Judiciare of Paris; Europol; Eurojust; the U.K.’s NCA; Germany’s Landeskriminalamt Schleswig-Holstein, Bundeskriminalamt, and the Central Cybercrime Department North Rhine-Westphalia; Switzerland’s Federal Office of Justice, Public Prosecutor’s Office of the Canton of Zurich, and Zurich Cantonal Police; Spain’s Policia Nacional and Guardia Civil; Japan’s National Police Agency; Australian Federal Police; Sweden’s Polismyndighetens; Canada’s Royal Canadian Mounted Police; Politie Dienst Regionale Recherche Oost-Brabant of the Netherlands; and Finland’s National Bureau of Investigation have provided significant assistance and coordination in these matters and in the LockBit investigation generally.

Trial Attorneys Debra Ireland and Jorge Gonzalez of the Criminal Division’s Computer Crime and Intellectual Property Section (CCIPS) and Assistant U.S. Attorneys Andrew M. Trombly, David E. Malagold, and Vinay Limbachia for the District of New Jersey are prosecuting the charges against Panev and the other previously charged LockBit defendants in the District of New Jersey.

The Justice Department’s Cybercrime Liaison Prosecutor to Eurojust, Office of International Affairs, and National Security Division also provided significant assistance.

Additional details on protecting networks against LockBit ransomware are available at StopRansomware.gov. These include Cybersecurity and Infrastructure Security Agency Advisories AA23-325A, AA23-165A, and AA23-075A. 

A criminal complaint is merely an allegation. All defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

Chen Jinping, 60, of New York, New York, pleaded guilty today to conspiring to act as an illegal agent of the government of the People’s Republic of China (PRC), in connection with opening and operating an undeclared overseas police station, located in lower Manhattan, for the PRC’s Ministry of Public Security (MPS).

“Today’s guilty plea holds the defendant accountable for his brazen efforts to operate an undeclared overseas police station on behalf of the PRC’s national police force — a clear affront to American sovereignty and danger to our community that will not be tolerated,” said Assistant Attorney General Matthew G. Olsen of the Justice Department’s National Security Division. “The Department of Justice will continue to pursue anyone who attempts to aid the PRC’s efforts to extend their repressive reach into the United States.”

“Today’s acknowledgment of guilt is a stark reminder of the insidious efforts taken by the PRC government to threaten, harass, and intimidate those who speak against their Communist Party,” said Executive Assistant Director Robert Wells of the FBI’s National Security Branch. “These blatant violations will not be tolerated on U.S. soil. The FBI remains committed to preserving the rights and freedoms of all people in our country and will defend against transnational repression at every front.”

“A priority of my office has been to counteract the malign activities of foreign governments that violate our nation’s sovereignty by targeting local diaspora communities in the United States,” said U.S. Attorney Breon Peace for the Eastern District of New York. “Today, a participant in a transnational repression scheme who worked to establish a secret police station in the middle of New York City on behalf of the national police force of the People’s Republic of China has pleaded guilty to conspiracy to act as an illegal agent. We will continue our efforts to protect the rights of vulnerable persons who come to this country to escape the repressive activities of authoritarian regimes.”

As alleged, Chen Jinping and co-defendant “Harry” Lu Jianwang conspired to act as illegal agents of the PRC government and also obstructed justice by destroying evidence of their communications with an MPS official. While acting under the direction and control of the MPS official, the defendants worked together to establish the first known overseas police station in the United States on behalf of the Fuzhou branch of the MPS. The police station — which closed in the fall of 2022 — occupied an entire floor in an office building in Manhattan’s Chinatown. Lu and Chen helped open and operate the clandestine police station. None of the participants in the scheme informed the U.S. government that they were helping the PRC government surreptitiously open and operate an undeclared MPS police station on U.S. soil.

In October 2022, the FBI conducted a judicially authorized search of the illegal police station. In connection with the search, FBI agents interviewed both defendants and seized their phones. In reviewing the contents of these phones, FBI agents observed that communications between the defendants and an MPS official appeared to have been deleted. In subsequent consensual interviews, the defendants admitted to the FBI that they had deleted their communications with the MPS official after learning about the ongoing FBI investigation, thus preventing the FBI from learning the full extent of the MPS’s directions for the overseas police station.

Chen faces a maximum penalty of five years in prison. Per Chen’s plea agreement, the government has agreed to dismiss the obstruction of justice charge against him. Lu has pleaded not guilty to both of the charges against him and is awaiting trial.

The FBI is investigating the case.

Assistant U.S. Attorneys Alexander A. Solomon and Antoinette N. Rangel for the Eastern District of New York and Trial Attorney Scott A. Claffee of the National Security Division’s Counterintelligence and Export Control Section are prosecuting the case.

The FBI has created a website for victims to report efforts by foreign governments to stalk, intimidate, or assault people in the United States. If you believe that you are or have been a victim of transnational repression, please visit www.fbi.gov/investigate/counterintelligence/transnational-repression.

PHILADELPHIA – United States Attorney David Metcalf announced that Aniruth Kuppusamy, 25, of Chesterbrook, Pennsylvania, was charged by indictment with one count each of manufacturing child pornography, receiving child pornography, possessing child pornography, and the use of an interstate commerce facility to entice a minor to engage in sexually explicit conduct.

As detailed in court filings, the defendant, who has been in custody since his arrest last month pursuant to a federal complaint and warrant, allegedly engaged in disturbing and violent conversations with Minor #1, who he knew was under the age of 18, and elicited sexually explicit videos of her.

In addition, the indictment alleges that the defendant knowingly received those visual depictions of Minor #1 engaged in sexually explicit conduct, and that he possessed images constituting child pornography on an iPhone 15 that had been shipped and transported using any means and facility of interstate and foreign commerce.

The indictment further alleges that Kuppusamy used a facility and means of interstate and foreign commerce, namely the internet and cellular telephone service, to persuade, induce, entice, and coerce Minor #1 to engage in sexual activity for which any person could be charged with a criminal offense, that is, the manufacture and receipt of child pornography.

If convicted, the defendant faces a mandatory minimum sentence of 15 years’ imprisonment and a maximum possible sentence of life in prison.

This case was brought as part of Project Safe Childhood, a nationwide initiative to combat the growing epidemic of child sexual exploitation and abuse launched in May 2006 by the Department of Justice. Led by United States Attorneys’ Offices and the Criminal Division’s Child Exploitation and Obscenity Section (CEOS), Project Safe Childhood marshals federal, state, and local resources to better locate, apprehend, and prosecute individuals who exploit children via the internet, as well as to identify and rescue victims. For more information about Project Safe Childhood, please visit projectsafechildhood.gov.

The case was investigated by the FBI and is being prosecuted by Assistant United States Attorney Danielle Bateman.

An indictment, information, or criminal complaint is an accusation. A defendant is presumed innocent unless and until proven guilty.