The US Justice Department (DOJ) has announced the indictment of a Russian national, 20-year-old Chech-born Ruslan Magomedovich Astamirov, for his involvement in multiple cyberattacks, including the deployment of LockBit ransomware. The attacks targeted computer systems in the U.S., Asia, Europe, and Africa. Astamirov was presented to the court yesterday. LockBit is part of a class of hacking methods and technologies dubbed ransomware as a service (RaaS).
Ruslan Astamirov, a citizen of the Russian-controlled Chechen Republic, was arrested by U.S. law enforcement at an unspecified date and faces charges of conspiracy to commit wire fraud and ransoming. He allegedly deployed ransomware called LockBit to steal sensitive data from the servers of businesses, then lock those systems and demand payment of hundreds of thousands of dollars. Astarimov allegedly threatened to release the data if the victims didn’t pay.
Astamirov is charged with conspiring to commit wire fraud and conspiring to damage protected computers intentionally. If convicted, he could face up to 20 years in prison for the first charge and up to five years for the second charge. Both charges carry a maximum fine of $250,000 or twice the gain or loss from the offense.
Deputy Attorney General Lisa O. Monaco emphasized the DOJ’s commitment to holding ransomware actors accountable. It stated that this arrest is the second related to LockBit in the past six months. US Attorney Philip R. Sellinger for the District of New Jersey highlighted that Astamirov is the third defendant charged in the LockBit global ransomware campaign and the second to be apprehended.
LockBit ransomware, which first appeared around January 2020, has been responsible for over 1,400 attacks worldwide, resulting in over $100 million in ransom demands. Astamirov, in furtherance of his activities, utilized various email addresses, IP addresses, and online provider accounts to deploy LockBit ransomware and communicate with victims. Law enforcement traced a portion of a victim’s ransom payment to a virtual currency address controlled by Astamirov.
This announcement follows previous LockBit-related charges against Mikhail Vasiliev, a dual Russian and Canadian national, and Mikhail Pavlovich Matveev, also known as Wazawaka, for alleged participation in separate ransomware conspiracies.
