The Department of Justice (DoJ) said today it has charged the alleged mastermind of the LockBit ransomware group – regarded by U.S. authorities as among the most prolific attackers worldwide since 2022 – with more than two dozen Federal crimes.
A total of 26 charges have been brought against Dimitry Yuryevich Khoroshev, a Russian national, by a Federal grand jury for the District of New Jersey. The charges – which include conspiracy to commit fraud, wire fraud, and extortion – carry a maximum penalty of 185 years in prison. It’s unclear whether Khoroshev, as a Russian national, will ever be brought to the U.S. for trial.
According to DoJ, Khoroshev acted as the LockBit ransomware group’s developer and administrator from its inception in 2019 through May of this year and operated LockBit as a ransomware-as-a-service business that was responsible for 2,500 attacks worldwide including 1,800 in the U.S.
Those attacks, DoJ said, generated at least $500 million in ransom payments from victims, with at least $100 million of that total going to Khoroshev personally.
“Khoroshev and his affiliate coconspirators, grew LockBit into what was, at times, the most active and destructive ransomware variant in the world,” DoJ said today.
LockBit victims included “individuals, small businesses, multinational corporations, hospitals, schools, nonprofit organizations, critical infrastructure, and government and law-enforcement agencies,” DoJ said.
The charges unveiled today follow actions announced in February by DoJ, the FBI, and the U.K. National Crime Agency’s (NCA) Cyber Division to disrupt LockBit’s operations. Those actions include the seizure of LockBit infrastructure, including decryption keys to help victims decrypt their captured systems and regain access to their data.
“Today we are going a step further, charging the individual who we allege developed and administered this malicious cyber scheme, which has targeted over 2,000 victims and stolen more than $100 million in ransomware payments,” said Attorney General Merrick Garland. “We will continue to work closely alongside our partners, across the U.S. government and around the world to disrupt cybercrime operations like LockBit and to find and hold accountable those responsible for them.”
“Working with U.S. and international partners, we are using all our tools to hold ransomware actors accountable – and we continue to encourage victims to report cyberattacks to the FBI when they happen,” said Deputy Attorney General Lisa Monaco today. “Reporting an attack could make all the difference in preventing the next one.”
“Today’s indictment of LockBit developer and operator Dimitry Yuryevich Khoroshev continues the FBI’s ongoing disruption of the LockBit criminal ecosystem,” commented FBI Director Christopher Wray. “The charges announced today reflect the FBI’s unyielding commitment to disrupting ransomware organizations and holding the perpetrators accountable.”
