The Department of Justice May 7 announced more than two dozen criminal charges against Dimitry Yuryevich Khoroshev, 31, of Voronezh, Russia, for his alleged role as the creator, developer and administrator of the LockBit ransomware group. According to the 26-count indictment and other records previously unsealed by the U.S. District Court of New Jersey, Khoroshev and coconspirators grew LockBit into what was, at times, the most active and destructive ransomware variant in the world. 

LockBit's victims included hospitals, individuals, small businesses, multinational corporations, schools, nonprofit organizations, critical infrastructure, and government and law-enforcement agencies. The group attacked more than 2,500 victims in at least 120 countries, including 1,800 victims in the U.S., and extracted at least $500 million in ransom payments from victims. The cyberattacks caused billions of dollars in broader losses such as revenue, incident response and recovery. 

"The combined efforts by the DOJ, FBI, Treasury and State departments to dismantle and disrupt the notorious and dangerous LockBit ransomware group should be congratulated," said John Riggi, AHA's national advisor for cybersecurity and risk. "Protected cooperation from the victims of LockBit was no doubt essential in the government’s efforts. As we see high-impact ransomware attacks against health care continue to disrupt patient care and pose a broad risk to patient and community safety, it has become clear that any defensive cyber measures imposed upon hospitals must be accompanied by an equally aggressive and sustained offensive strategy by the U.S. government to combat this ongoing and unresolved national security threat. These attacks should be aggressively pursued and prosecuted as such by the federal government. We use the term 'prosecuted' in all senses of the definition related to the totality of the government’s capabilities and authorities, including intelligence and military authorities.” 

For more information on this or other cybersecurity and risk issues, contact Riggi at jriggi@aha.org. For the latest cyber threat intelligence and resources visit www.aha.org/cybersecurity.

Related News Articles

Headline
The FBI Aug. 20 released an advisory warning of malicious activity by Russian cyber actors targeting end-of-life devices running an unpatched vulnerability in…
Headline
The Cybersecurity and Infrastructure Security Agency, Environmental Protection Agency, National Security Agency, FBI and international agencies Aug. 13…
Headline
The Department of Justice Aug. 11 announced a series of actions taken against the BlackSuit ransomware group, also known as “Royal,” including the disruption…
Headline
The FBI, Cybersecurity and Infrastructure Security Agency and international agencies July 29 released a joint advisory on recent tactics by the Scattered…
Headline
Microsoft July 22 released an update on the ongoing cyberattacks to SharePoint servers used within organizations, attributing the incidents to China-based…
Headline
The FBI, Cybersecurity and Infrastructure Security Agency, Department of Health and Human Services, and Multi-State Information Sharing and Analysis Center…