According to official publications from the U.S. Department of Justice and the United States Attorney's Office District of New Jersey, on March 13, 2025, the Israeli and American dual citizen Rostislav Panev was deported from Israel (where he was arrested in August 2024) and is awaiting to face 41 criminal charges (including conspiracy to commit computer and wire fraud, damage and extortion in relation to computers and information), due to his alleged participation in the development of the LockBit ransomware.

-

According to the legal documentation in this process, Panev admitted to the Israeli authorities who arrested him his participation in the development of LockBit from its initial conception in 2019 until 2024. His role in the organization was to create functionalities for the malware, such as disabling antivirus on victim devices and directly within the payload itself. In addition to the above, Panev declared that he had infected victim networks and even executed scripts that forced the printers of those networks to print LockBit ransom notes.

-

Israeli law enforcement found evidence on Panev's electronic devices that supports these statements, including credentials for access to a server hosted on the darknet that housed various variations of the LockBit builder, with the aim of making it more customizable according to the needs of the "affiliates" and more effective against the victims they chose to attack, as well as credentials for LockBit's own control panel, its online dashboard. The source code of LockBit’s StealBit tool, which facilitated the channeling of stolen information from victims to LockBit servers for "affiliates," was also found.

-

Authorities were also able to prove the receipt of payments for his services, amounting to approximately $1/4 million, during the period he worked for the organization.

-

The case is still in process, and up to the date of this publication, there has been no verdict.