US and allies sanction LockBit leaders over ransomware attacks

The United States, Britain and Australia announced sanctions on Tuesday against the leader of Russian ransomware firm LockBit, which they accuse of extorting billions of dollars from thousands of victims.

The measures announced Tuesday are the latest in a long-running legal and technological battle by law enforcement agencies around the world against LockBit to disrupt its activities.

The U.S. Treasury Department said it hired Dmitry Khoroshev to develop and distribute the software, which was used against a number of American targets – including a hospital in Chicago.

“Today’s action sends a clear signal that the United States and our partners around the world are committed to dismantling the ransomware ecosystem,” Brian Nelson, the Treasury Department’s undersecretary for terrorism and financial intelligence, said in a statement.

In addition to the Treasury Department, the US State Department announced rewards of up to $15 million for information about the company.

The British government also said it had also imposed sanctions on Khoroshev in cooperation with the United States and Australia.

The group was responsible for a quarter of all ransomware attacks worldwide last year and extorted “over $1 billion from thousands of victims worldwide,” a British government statement said.

“LockBit orchestrated a malicious online campaign that illegally stole sensitive data and used it to extort billions of dollars from companies and individuals,” it said, adding that more than 200 British companies had been targeted.

– DOJ files charges against Khoroshev –

At the same time, the US Justice Department on Tuesday dropped charges against Khoroshev, 31, for his role as head of LockBit.

Khoroshev, a Russian citizen, was indicted by a grand jury in New Jersey on 26 counts, the DOJ said in a statement.

“Earlier this year, the Department of Justice and our UK law enforcement partners disrupted LockBit,” said US Attorney General Merrick Garland. “Today we are going one step further and charging the person we believe developed and managed this malicious cyber program.”

Europol, the European Union’s law enforcement agency, said the sanctions announced Tuesday were part of a concerted global campaign to “seriously damage the performance and credibility of the LockBit ransomware group.”

“The true impact of LockBit’s crime was previously unknown, but data obtained from their systems showed that more than 7,000 attacks were constructed using their services between June 2022 and February 2024,” it said in a statement.

The five countries most affected by LockBit are the United States, Great Britain, France, Germany and China, it said.

there/nro