On Tuesday, U.S. and British authorities revealed that the mastermind behind LockBit, one of the most prolific and damaging ransomware groups in history, is a 31-year-old Russian national named Dmitry Yuryevich Khoroshev, also known as “LockbitSupp.” I made it clear.
As is customary for such announcements, law enforcement agencies released a photo of Khoroshev and details of his group's activities. The U.S. Department of Justice indicted Khoroshev on several counts of computer crimes, fraud, and extortion. And in the process, federal authorities also uncovered details about Rockbit's past activities.
Earlier this year, authorities seized Rockbit's infrastructure and gang databanks, revealing key details of how Rockbit works.
Today, we revealed details of what federal authorities call a “large-scale criminal organization that sometimes ranks as the world's most prolific and destructive ransomware group.”
Here's what we learned from Khoroshev's indictment:
Khoroshev had a second nickname, the Putin Club.
LockBit's leader was publicly known by the less imaginative nickname LockBitSupp. But Khoroshev also had another online identity of his, the Putin Club. The indictment does not include information about online handles, but appears to refer to Russian President Vladimir Putin. However, there are several profiles on the Internet using the same nickname on Flickr, YouTube, and Reddit, but it is unclear whether these accounts are run by Khoroshev.
LockBit also hit victims in Russia
Experts say there is a sacred unwritten rule in Russia's cybercrime world that if you hack someone outside Russia, local authorities will leave you alone. Alarmingly, according to federal authorities, Khoroshev and his co-conspirators “also deployed Lockbit against multiple Russian victims.”
It remains to be seen whether this means Russian authorities will go after Khoroshev, but at least now we know who he is.
Khoroshev continued to closely monitor his affiliates.
Ransomware operations like LockBit are known as ransomware-as-a-service. That means there are developers like Khoroshev who create the software and infrastructure, and there are affiliate companies that operate and deploy that software, infecting victims, and extorting ransoms. Federal authorities alleged that the officials paid Mr. Khoroshev about 20% of the processing fee.
According to the indictment, this business model allowed Khoroshev to “closely monitor” his affiliates, including accessing and sometimes participating in negotiations with his victims. Khoroshev “also requested identification documents from his co-conspirators at affiliated companies, which he also stored on his infrastructure.” Perhaps this is how law enforcement was able to identify some of Rockbit's affiliates.
Khoroshev has also developed a tool called StealBit that complements major ransomware. Using this tool, affiliates were able to store stolen data from victims on Holoshev's servers and, in some cases, publish it on Rockbit's official dark web leak site.
LockBit ransomware payments amount to approximately $500 million
LockBit was founded in 2020, and since then, its affiliates have successfully extorted at least approximately $500 million from approximately 2,500 victims. Victims range from “large multinational corporations to small businesses and individuals, as well as hospitals, schools, nonprofit organizations, critical infrastructure facilities, and government and law enforcement agencies.”
Apart from paying ransoms, Rockbit said the gang disrupted victims' operations and forced many to pay for incident response and recovery services, causing “a total of billions of US dollars in damages worldwide.” ” federal authorities claimed.
Mr. Khoroshev contacted authorities to identify some of those involved.
Perhaps the most shocking of the latest revelations is that in February, after a global law enforcement coalition shut down Rockbit's website and infrastructure, Khoroshev “contacted law enforcement and provided services in exchange for information regarding the identity of [ransomware-as-a-service] competitor. ”
According to the indictment, Khoroshev asked law enforcement:[g]Please tell me the name of my enemy. ”