The United States has unsealed a criminal complaint against Rostislav Panev, a 51-year-old dual Russian-Israeli national accused of serving as a software developer for the notorious LockBit ransomware group. Panev, currently detained in Israel, faces 40 charges, including computer damage and extortion, as the U.S. seeks his extradition.
Allegations of Involvement in LockBit Operations
The complaint outlines Panev’s alleged involvement with LockBit from 2019 to February 2024, when law enforcement dismantled the ransomware gang’s darknet infrastructure. Evidence linking Panev to LockBit includes access to the group’s control panel—restricted to vetted members—and the development of multiple LockBit builders, the software used to generate ransomware.
Panev is also accused of coding tools to disable antivirus software, spread malware across networks, and print ransom notes on all connected printers. Investigators allege that Panev earned approximately $230,000 in cryptocurrency for his work.
Panev’s Defense
Panev’s lawyer, Sharon Nahari, has claimed that his client’s role was limited to software development and that Panev was unaware of the group’s criminal activities. However, U.S. authorities argue that Panev continued to work for LockBit despite realizing his actions were unlawful, motivated by financial compensation.
International Law Enforcement Efforts
Panev’s arrest is the latest development in an international crackdown on LockBit affiliates. Authorities have also targeted other ransomware actors, including Aleksandr Ryzhenkov, linked to Evil Corp, and Dmitry Khoroshev, alleged to be the leader of LockBit. U.S. Deputy Attorney General Lisa Monaco praised the success of these efforts, highlighting them as a model for future ransomware investigations.
Extradition Pending
Israeli authorities are currently reviewing the U.S. extradition request. Panev’s case underscores the global reach of ransomware groups and the importance of international cooperation in combating cybercrime.
A Broader Crackdown
The takedown of LockBit and arrests of its affiliates mark significant steps in dismantling one of the most destructive ransomware organizations. As governments and law enforcement agencies continue to collaborate, these actions send a strong message about the consequences of participating in cybercriminal activities.

