{"id":4593,"date":"2024-07-22T15:50:59","date_gmt":"2024-07-22T20:50:59","guid":{"rendered":"https:\/\/www.darkreading.com\/cyberattacks-data-breaches\/two-foreign-nationals-plead-guilty-to-participating-in-lockbit-ransomware-group"},"modified":"2024-07-22T15:50:59","modified_gmt":"2024-07-22T20:50:59","slug":"two-foreign-nationals-plead-guilty-to-participating-in-lockbit-ransomware-group","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2024\/07\/22\/two-foreign-nationals-plead-guilty-to-participating-in-lockbit-ransomware-group\/","title":{"rendered":"Two Foreign Nationals Plead Guilty to Participating in LockBit Ransomware Group"},"content":{"rendered":"
<\/a><\/div>\n
<\/div>\n

PRESS RELEASE<\/span><\/span><\/p>\n

Two foreign nationals pleaded guilty today to participating in the LockBit ransomware group\u2014at various times the most prolific ransomware variant in the world\u2014and to deploying LockBit attacks against victims in the United States and worldwide.<\/span><\/p>\n

\u201cToday\u2019s convictions reflect the latest returns on the Department\u2019s investment in disrupting ransomware threats, prioritizing victims, and holding cybercriminals accountable,\u201d said Deputy Attorney General Lisa Monaco. \u201cIn executing our all-tools cyber enforcement strategy, we\u2019ve dealt significant blows to destructive ransomware groups like LockBit, as we did earlier this year, seizing control of LockBit infrastructure and distributing decryption keys to their victims. Today\u2019s actions serve as a warning to ransomware actors who would attack Americans: we will find you and hold you accountable.\u201d  <\/span><\/p>\n

\u201cThe defendants committed ransomware attacks against victims in the United States and around the world through LockBit, which was one of the most destructive ransomware groups in the world,\u201d said Principal Deputy Assistant Attorney General Nicole M. Argentieri, head of the Justice Department\u2019s Criminal Division. \u201cBut thanks to the work of the Computer Crime and Intellectual Property Section, along with its domestic and international partners, LockBit no longer claims that title. Today\u2019s convictions represent another important milestone in the Criminal Division\u2019s ongoing effort to disrupt and dismantle ransomware groups, protect victims, and bring cybercriminals to justice.\u201d<\/span><\/p>\n

According to court documents, Ruslan Magomedovich Astamirov (\u0410\u0421\u0422\u0410\u041c\u0418\u0420\u041e\u0412, \u0420\u0443\u0441\u043b\u0430\u043d \u041c\u0430\u0433\u043e\u043c\u0435\u0434\u043e\u0432\u0438\u0447\u044c), 21, a Russian national of the Chechen Republic, Russia, and Mikhail Vasiliev, 34, a dual Canadian and Russian national of Bradford, Ontario, were members of LockBit. In the period between January 2020 and February 2024, LockBit grew into what was, at times, the most active and destructive ransomware group in the world. LockBit attacked more than 2,500 victims in at least 120 countries, including 1,800 victims in the United States. Those victims included individuals, small businesses, multinational corporations, hospitals, schools, nonprofit organizations, critical infrastructure, and government and law-enforcement agencies. LockBit\u2019s members extorted at least approximately $500 million in ransom payments from their victims and caused billions of dollars in additional losses to victims, including costs like lost revenue and for incident response and recovery.<\/span><\/p>\n

LockBit\u2019s \u201caffiliate\u201d members, including Vasiliev and Astamirov, first identified and unlawfully accessed vulnerable computer systems, and then deployed LockBit ransomware on those systems to both steal and encrypt stored data. When LockBit attacks were successful, LockBit\u2019s affiliate members then demanded ransoms from their victims in exchange for decrypting the victims\u2019 data and then claiming to delete the affiliates\u2019 copies of the data. When victims did not pay the demanded ransoms, LockBit\u2019s affiliates often left the victim\u2019s data permanently encrypted and publish the stolen data, including highly sensitive information, on a publicly accessible internet site under LockBit\u2019s control.<\/span><\/p>\n

\u201cAstamirov and Vasiliev thought that they could deploy LockBit from the shadows, wreaking havoc and pocketing massive ransom payments from their victims, without consequence,\u201d said U.S. Attorney Philip R. Sellinger for the District of New Jersey. \u201cThey were wrong. We, in New Jersey, along with our domestic and international law enforcement partners will do everything in our power to hold LockBit\u2019s members and other cybercriminals accountable, disrupt and dismantle their operations, and put a spotlight on them as wanted criminals\u2014no matter where they hide.\u201d<\/span><\/p>\n

\u201cAstamirov and Vasiliev were members of the LockBit ransomware group, which has caused severe harm around the globe by attacking computer systems in over a hundred countries damaging organizations ranging from government and law-enforcement agencies to hospitals and schools,\u201d said FBI Deputy Director Paul Abbate. \u201cToday\u2019s plea shows our relentless and unwavering commitment to ensuring that cyber criminals are brought to justice for their actions. The FBI is proud of the international collaboration that led to these individuals being held accountable under the law for the damage their actions have caused.\u201d<\/span><\/p>\n

Between 2020 and 2023, Astamirov deployed LockBit against at least 12 victims, including businesses in Virginia, Japan, France, Scotland, and Kenya. Operating under the online aliases \u201cBETTERPAY,\u201d \u201cofftitan,\u201d and \u201cEastfarmer,\u201d he extorted $1.9 million from those victims. As part of his plea agreement, Astamirov agreed to forfeit, among other assets, $350,000 in seized cryptocurrency that he extorted from one of his LockBit victims. Astamirov was first <\/span>charged and arrested<\/a><\/span> in this matter in June 2023.<\/span><\/p>\n

Between 2021 and 2023, Vasiliev, operating under the online aliases \u201cGhostrider,\u201d \u201cFree,\u201d \u201cDigitalocean90,\u201d \u201cDigitalocean99,\u201d \u201cDigitalwaters99,\u201d and \u201cNewwave110,\u201d deployed LockBit against at least 12 victims, including businesses in New Jersey, Michigan, the United Kingdom, and Switzerland. He also deployed LockBit against an educational facility in England and a school in Switzerland. Through these attacks, Vasiliev caused at least $500,000 in damage and losses to his victims. Vasiliev was first <\/span>charged<\/a><\/span> in this matter and arrested in Canada by Canadian authorities in November 2022, and extradited to the United States in June.<\/span><\/p>\n

Astamirov pleaded guilty to a two-count information charging him with conspiracy to commit computer fraud and abuse and conspiracy to commit wire fraud. He faces a maximum penalty of 25 years in prison. Vasiliev pleaded guilty to a four-count information charging him with conspiracy to commit computer fraud and abuse, intentional damage to a protected computer, transmission of a threat in relation to damaging a protected computer, and conspiracy to commit wire fraud. He faces a maximum penalty of 45 years in prison. A sentencing date has not yet been set. A federal district court judge will determine any sentence after considering the U.S. Sentencing Guidelines and other statutory factors.<\/span><\/p>\n

The LockBit Investigation<\/span><\/span><\/p>\n

Today\u2019s guilty pleas follow a recent <\/span>disruption<\/a><\/span> of LockBit ransomware in February by the U.K. National Crime Agency\u2019s (NCA) Cyber Division, which worked in cooperation with the Justice Department, FBI, and other international law enforcement partners. As previously announced by the Department, authorities disrupted LockBit by seizing numerous public-facing websites used by LockBit to connect to the organization\u2019s infrastructure and by seizing control of servers used by LockBit administrators, thereby disrupting the ability of LockBit actors to attack and encrypt networks and extort victims by threatening to publish stolen data. This disruption succeeded in greatly diminishing LockBit\u2019s reputation and its ability to attack further victims, as alleged by documents filed in this case.<\/span><\/p>\n

Today\u2019s guilty pleas also follow prior announcements of charges brought in the District of New Jersey against four other LockBit members, including its alleged creator, developer, and administrator, Dmitry Yuryevich Khoroshev. According to <\/span>an indictment<\/a><\/span> unsealed in May, Khoroshev allegedly acted as the group\u2019s administrator from as early as September 2019 through 2024. In that role,  Khoroshev recruited new affiliate members, spoke for the group publicly under the alias \u201cLockBitSupp,\u201d and developed and maintained the infrastructure used by affiliates to deploy LockBit attacks. Khoroshev also took 20% of each ransom paid by LockBit victims, allowing him to personally derive at least $100 million over that period. Khoroshev is currently the subject of a reward of up to $10 million through the U.S. Department of State\u2019s Transnational Organized Crime (TOC) Rewards Program, with information accepted through the FBI tip website at https:\/\/tips.fbi.gov\/home.<\/span><\/p>\n

Other charges against LockBit members include the following:<\/span><\/p>\n

\n