The Alleged LockBit Ransomware Mastermind Has Been Identified

Law enforcement in the United States, United Kingdom, and Australia today jointly named Russian national Dmitry Yuryevich Khoroshev as the alleged operator of the LockBitSupp handle and the organizational mastermind behind the notorious LockBit ransomware group, which has been on a multiyear hacking rampage exporting an estimated $500 million from its victims.

For years, the leader of LockBit has remained an enigma. Carefully hiding behind their online moniker, LockBitSupp has evaded identification and bragged that people wouldn’t be able to reveal their offline identity—even offering a $10 million reward for their real name.

Law enforcement’s linking of Khoroshev to LockBitSupp comes after police in the UK infiltrated the LockBit group’s systems and made several arrests—taking its servers offline, gathering the group’s internal communications, and putting a stop to LockBit’s hacking spree. The law enforcement takedown, dubbed Operation Cronos and led by the UK’s National Crime Agency (NCA), has essentially neutralized the hacking group and sent ripples through the wider Russian cybercrime ecosystem.

In addition to being named, Khoroshev has also been sanctioned by the US, UK, and Australia. According to the US Office of Foreign Assets Control, Khoroshev is 31 and lives in Russia, with details of his sanction designation also listing multiple email addresses and cryptocurrency addresses, alongside his Russian passport details. The US has also filed an indictment against him.

Khoroshev did not immediately respond to messages sent to email addresses listed in the sanctions.

A 26-count indictment published by the US Department of Justice lists a litany of charges, including: conspiracy to commit fraud, extortion, and hacking. The charges have a maximum penalty of 185 years in prison, the DOJ says.

The indictment says Khoroshev has acted as the LockBit group's “developer and administrator” since around September 2019, designing and developing its “control panel” used within ransomware attacks. Khoroshev and the LockBit group managed to extort at least $500 million from victims in 120 countries around the world, including Russia, which is rarely targeted by Russian