DOJ charges Russian national with developing, operating LockBit ransomware

The Department of Justice May 7 announced more than two dozen criminal charges against Dimitry Yuryevich Khoroshev, 31, of Voronezh, Russia, for his alleged role as the creator, developer and administrator of the LockBit ransomware group. According to the 26-count indictment and other records previously unsealed by the U.S. District Court of New Jersey, Khoroshev and coconspirators grew LockBit into what was, at times, the most active and destructive ransomware variant in the world. 

LockBit's victims included hospitals, individuals, small businesses, multinational corporations, schools, nonprofit organizations, critical infrastructure, and government and law-enforcement agencies. The group attacked more than 2,500 victims in at least 120 countries, including 1,800 victims in the U.S., and extracted at least $500 million in ransom payments from victims. The cyberattacks caused billions of dollars in broader losses such as revenue, incident response and recovery. 

"The combined efforts by the DOJ, FBI, Treasury and State departments to dismantle and disrupt the notorious and dangerous LockBit ransomware group should be congratulated," said John Riggi, AHA's national advisor for cybersecurity and risk. "Protected cooperation from the victims of LockBit was no doubt essential in the government’s efforts. As we see high-impact ransomware attacks against health care continue to disrupt patient care and pose a broad risk to patient and community safety, it has become clear that any defensive cyber measures imposed upon hospitals must be accompanied by an equally aggressive and sustained offensive strategy by the U.S. government to combat this ongoing and unresolved national security threat. These attacks should be aggressively pursued and prosecuted as such by the federal government. We use the term 'prosecuted' in all senses of the definition related to the totality of the government’s capabilities and authorities, including intelligence and military authorities.” 

For more information on this or other cybersecurity and risk issues, contact Riggi at jriggi@aha.org. For the latest cyber threat intelligence and resources visit www.aha.org/cybersecurity.