Justice Department Charges Russian National for LockBit Ransomware Attacks

On June 15, the Justice Department announced charges against Ruslan Magomedovich Astamirov, a 20-year old Russian national. Astamirov is charged on two counts having to do with the LockBit ransomware campaign: conspiring to commit wire fraud and conspiring to intentionally damage protected computers and to transmit ransom demands. 

The LockBit ransomware variant operates as a “ransomware-as-a-service,” a model “where affiliates are recruited to conduct ransomware attacks using LockBit ransomware tools and infrastructure.” This results in a “web of unconnected threat actors.” The variant first appeared around January 2020, and has since executed at least 1,800 attacks against systems in the United States, Asia, Europe, and Africa. According to the criminal complaint, LockBit actors have issued over $100 million in ransom demands and received tens of millions of dollars in bitcoin payments. It was the most deployed ransomware variant in 2022. 

The District of New Jersey has charged three defendants as part of the global ransomware campaign. This is the second LockBit-related arrest in six months. In a recent Cybersecurity Advisory, CISA, the FBI, the Multi-State Information Sharing and Analysis Center (MS-ISAC), and the cybersecurity authorities of Australia, Canada, the United Kingdom, France, Germany, and New Zealand offers details on observed activity, and provides mitigations to support network defenders against the variant.

You can read the complaint here or below and see the Justice Department’s announcement here.