UK and allies unmask and sanction Russian leader of LockBit cybercrime gang

A wanted poster released by law enforcement shows a reward for an alleged member of the cybercrime gang LockBit, Dmitry Yuryevich Khroroshev. U.S. law enforcement/Handout via REUTERS

By James Pearson and Sachin Ravikumar

LONDON (Reuters) -Britain, the U.S. and Australia have sanctioned and unmasked a senior Russian leader of the notorious cybercrime gang LockBit, the British government said on Tuesday.

Dmitry Khoroshev will face asset freezes and travel bans after being identified as one of the leaders of LockBit, the ransomware group which has digitally extorted over $1 billion from victims worldwide, it said.

“These sanctions are hugely significant and show that there is no hiding place for cyber criminals like Dmitry Khoroshev, who wreak havoc across the globe. He was certain he could remain anonymous, but he was wrong,” Graeme Biggar, Director General of Britain’s National Crime Agency, said in a statement.

FILE PHOTO: A screenshot taken on February 19, 2024 shows a take down notice that a group of global intelligence agencies issued to a dark web site called Lockbit. Handout via REUTERS/File Photo

LockBit was first disrupted by the NCA, U.S. Department of Justice, FBI and Europol in February, in an unprecedented campaign that saw the gang’s darkweb site hijacked by police and used to leak internal information about the group and the people behind it.

“In sanctioning one of the leaders of LockBit we are taking direct action against those who continue to threaten global security, while simultaneously exposing the malicious cyber-criminal activity emanating from Russia,” Britain’s Sanctions Minister Anne-Marie Trevelyan said in a statement.

Ransomware is malicious software that encrypts data; Lockbit and its affiliates make money by coercing its targets into paying ransom to decrypt or unlock that data with a digital key. The gang’s digital extortion tools have been used against some of the world’s largest organisations.

CRIMINAL GROUPS

Its affiliates are like-minded criminal groups that Lockbit recruits to wage attacks using those tools. Those affiliates carry out the attacks, and provide Lockbit a cut of the ransom, which is usually demanded in the form of cryptocurrency, making it harder to trace.

In February, the U.S. announced it had charged two Russian nationals with deploying Lockbit ransomware against companies and groups around the world. Both men were also sanctioned by the U.S. Treasury.

Before it was seized by law enforcement, Lockbit’s website displayed an ever-growing gallery of victim organisations that was updated nearly daily. Next to their names were digital clocks that showed the number of days left to the deadline given to each organisation to provide ransom payment.

On Tuesday, international police agencies once again turned that platform against the gang itself to unmask Khoroshev and published a wanted poster promising a $10 million award for information that would lead to Khoroshev’s arrest.

According to a 26-count U.S. indictment unsealed on Tuesday, Khoroshev received at least $100 million in Bitcoin payments from LockBit’s activity. Reuters was unable to find contact information for Khoroshev or his lawyer.

(Reporting by James Pearson and Sachin RavikumarAdditional reporting by Karen Freifeld in New YorkEditing by William James, Sarah Young, Christina Fincher and Gareth Jones)