“A threat that attacks schools and hospitals”: the federal government unmasks a cybercriminal

The US government has launched a manhunt for a Russian fugitive with a $10 million reward on his head for running the world’s largest ransomware scheme that attempted to extort millions from notable targets including Boeing and the British Royal Mail service.

Dmitry Yuryevich Khoroshev, 31, of Voronezh, Russia, was the leader and developer of LockBit, a ransomware mercenary group hired for cyberattacks against organizations ranging from nonprofits to hospitals to schools, according to a federal indictment unsealed this week.

“Most people would not consider being accused of creating and administering the world’s most destructive ransomware group a badge of honor,” said FBI Special Agent in Charge James E. Dennehy. –Newark. “Khoroshev, wears it like an Olympic gold medal.”

Khoroshev’s whereabouts are unknown. The State Department announced a reward of up to $10 million for information leading to his arrest.

Lockbit ransomware, first spotted on Russian-language cybercrime forums in January 2020, has been detected all over the world, with organizations in the United States, India and Brazil among common targets, the company said. cybersecurity company Trend Micro last year.

Reuters reported last year that Lockbit hackers said they had obtained “a huge amount” of sensitive data from aerospace giant Boeing and would put it online if Boeing did not pay a massive ransom. Boeing confirmed in November that parts of its parts and distribution businesses had suffered “a cybersecurity incident” but said there was no threat to aircraft or flight safety.

LockBit also threatened at one point to release the stolen data if the UK’s Royal Mail service did not pay a ransom. In an emailed response to Reuters, Royal Mail said evidence from its investigation suggested that data allegedly obtained from its network did not contain any financial or other sensitive customer information.

Khoroshev is charged with conspiracy to commit fraud, extortion and related computer activities; conspiracy to commit wire fraud; and eight counts each of intentional damage to a protected computer, extortion in connection with information illegally obtained from a protected computer, and extortion in connection with intentional damage to a protected computer.

The Justice Department’s unmasking and indictment of the Russian national behind LockBit is the latest in federal efforts to stop the ransomware group behind attacks in nearly 120 countries that extorted half a billion dollars, of which Khoroshev took 20%, according to federal prosecutors in New Jersey. . Five accomplices have been charged and two are awaiting detention.

The announcement follows a February operation by federal officials and U.K. law enforcement to disrupt LockBit’s plans, Nicole M. Argentieri, principal assistant attorney general, said in a video announcing the announcement. indictment.

The Justice Department official called ransomware “a threat that attacks schools, hospitals and other critical infrastructure.”

A cyber gun for rent

The ransomware, or software developed by Khoroshev, allowed criminals to steal a victim’s data and keep it under threat of publishing it if the victim did not pay, according to the indictment.

Ransomware works by using a number of techniques, such as hacking or credential theft, to gain access to a victim’s computer, the indictment states. Then, a customized version of LockBit is used to steal documents and data.

Then, the criminals leave behind a “ransom note” containing instructions on how to make contact for negotiations and a threat of publication if the victim does not do so, the indictment says. The criminals usually demanded the ransom in Bitcoin.

Khoroshev began developing and marketing the ransomware under aliases such as “LockBitSupp” and “putinkrab” in September 2019, according to the filing. Third parties actually rented it to deploy on victims, but the Russian national monitored and even participated in ransom negotiations, the indictment states.

He marketed it on Dark Web cybercriminal forums, paying people $1,000 to get the LockBit logo tattooed on them as a sort of corporate brand, and turned the cyber-gun-for-hire “into a criminal organization massive which has sometimes ranked first”. most prolific and destructive ransomware group in the world,” the indictment states.

More:Global hacking campaign: Department of Energy and other agencies hit by wave of cyberattacks.

Eliminate “putinkrab”

After roughly four years of ransomware schemes, law enforcement agencies in the US, UK and “around the world” left LockBit “virtually unusable” in a coordinated strike in February, according to the act of accusation.

British authorities reviewed the seized LockBit data and discovered lists of buyers, victims and documents that were allegedly deleted after the ransom was paid, the indictment says.

Of the 2,500 victims, about 1,800 were in the United States and at least 55 were in New Jersey, according to the filing. However, the range of victims extends from Argentina and Kenya to Finland and China.

Among the victims mentioned in the lawsuit was a “multinational aerospace and defense company headquartered in Virginia” that received a $200 million ransom demand. The attacks were costly for victims to deal with and resulted in loss of income.

Also noted was a medical services company based in Florida; a “major” Taiwanese semiconductor manufacturer; a German auto parts conglomerate; and, in New Jersey, law enforcement in Passaic and Monmouth counties and a school district in Somerset County.

“A threat that attacks schools and hospitals”: the federal government unmasks a cybercriminal

After the February disruption, Khoroshev attempted to revive LockBit. In an effort to beat ransomware competition, he “communicated with law enforcement and offered his services in exchange for information on the identities” of competitors, according to the indictment.

The Russian national reportedly said: “Give me the names of my enemies.