Israeli authorities have arrested Rostislav Panev, a 51-year-old dual Russian-Israeli citizen, for his alleged role as a key developer of the notorious LockBit ransomware operation. The arrest, which took place in August, was made following a U.S. provisional arrest request.
According to the U.S. Department of Justice, Panev played an instrumental role in LockBit's operations since its launch in 2019. As a developer, he allegedly created malware code and maintained the infrastructure used by the ransomware group and its affiliates.
The criminal complaint reveals that at the time of his arrest, Panev had administrator credentials for LockBit's Dark Web repository containing the ransomware's source code. Investigators also found access credentials for the LockBit control panel and the source code for "StealBit," a tool used to steal data from victims.
During interviews with Israeli authorities, Panev admitted to performing coding, development, and consulting work for LockBit. His tasks included creating code to disable antivirus software and deploy malware across victim networks. Court documents show he received monthly cryptocurrency payments of approximately $10,000, totaling over $230,000 between June 2022 and February 2024.
LockBit has been one of the most destructive ransomware groups globally, responsible for over 2,500 attacks across 120 countries. The group has extracted more than $500 million in ransom payments and caused billions in damages to victims, including hospitals, schools, businesses, and government agencies.
The arrest is part of a broader international effort to dismantle LockBit's operations. Two other key members are already in custody, while several others remain at large, including the group's primary administrator, Dmitry Khoroshev.
Panev is currently awaiting extradition to the United States. His lawyer maintains that Panev was neither aware of nor involved in the alleged schemes. An extradition hearing is scheduled for next month in Israel.