Rostislav Panev, a 51-year-old dual Russian and Israeli national, has been extradited from Israel to the United States to face charges for his alleged involvement in the LockBit ransomware group, a notorious cybercrime operation responsible for extorting over $500 million from victims worldwide. The U.S. Department of Justice announced the extradition on Thursday, marking a significant step in the ongoing international effort to dismantle one of the most destructive ransomware networks in history.
Panev was arrested in Israel in August 2024 following a U.S. provisional arrest request. After months of legal proceedings, he arrived in the United States and made his initial appearance before U.S. Magistrate Judge André M. Espinosa in the District of New Jersey. The judge ordered Panev detained pending trial, where he faces charges of conspiracy to commit fraud, cybercrime, wire fraud, and other related offenses.
According to a superseding criminal complaint unsealed in December 2024, Panev served as a key developer for LockBit, a ransomware-as-a-service (RaaS) group that emerged in 2019 and grew to become a global menace. The group is accused of targeting over 2,500 victims across 120 countries, including 1,800 in the U.S., hitting a wide range of sectors such as hospitals, schools, government agencies, and multinational corporations. LockBit’s attacks reportedly caused billions of dollars in damages, including lost revenue and recovery costs, beyond the $500 million extorted in ransom payments.
Investigators allege that Panev played a pivotal role in designing the LockBit malware and maintaining its infrastructure. Following his arrest, Israeli authorities searched his Haifa residence and uncovered damning evidence, including administrator credentials for a dark web repository containing source code for multiple versions of the LockBit builder—a tool affiliates used to customize ransomware for specific targets. They also found source code for “StealBit,” a utility that facilitated data theft during attacks, and access credentials for the LockBit control panel, an online dashboard used by affiliates.
Court documents further reveal that Panev exchanged direct messages with Dmitry Yuryevich Khoroshev, believed to be LockBit’s primary administrator (known online as “LockBitSupp”), discussing technical enhancements to the ransomware’s builder and control panel. Between June 2022 and February 2024, Panev allegedly received approximately $10,000 per month in cryptocurrency payments—totaling over $230,000—laundered through illicit mixing services, for his contributions to the group.
In interviews with Israeli authorities post-arrest, Panev reportedly admitted to performing coding, development, and consulting work for LockBit, including creating code to disable antivirus software, deploy malware across victim networks, and print ransom notes on connected printers. He claimed his motivation was financial, though his attorney, Sharon Nahari, has maintained that Panev was unaware his work would be used for criminal purposes.
U.S. Attorney John Giordano for the District of New Jersey emphasized the significance of the extradition, stating, “Rostislav Panev’s arrival in the United States sends a clear message: if you contribute to the LockBit ransomware conspiracy, we will track you down and hold you accountable. Our commitment to combating cybercrime remains unwavering, and this case exemplifies our resolve.”
The extradition follows a broader crackdown on LockBit, including a February 2024 disruption led by the U.K.’s National Crime Agency, in collaboration with the FBI and other global partners, which seized key infrastructure and diminished the group’s operational capacity. Despite attempts to regroup, including plans for a “LockBit 4.0” release in 2025, the arrests of Panev and two other members—along with charges against seven key figures—signal a severe blow to the organization.
Panev’s case is being prosecuted by Assistant U.S. Attorneys Andrew M. Trombly, David E. Malagold, and Vinay Limbachia, alongside the Justice Department’s Computer Crime and Intellectual Property Section. As the trial looms, authorities continue to pursue other LockBit affiliates, with the U.S. State Department offering up to $10 million for information leading to the capture of Khoroshev and other fugitives.
