How Did Authorities Identify the Alleged Lockbit Boss?
Summary: The U.S. indicted Russian national Dmitry Yuryevich Khoroshev on 26 criminal counts on May 7, alleging he created and sold LockBit ransomware and personally extorted more than $100 million from hundreds of victims, while the group took in roughly half a billion dollars over four years. Treasury sanctions listed his Voronezh address, passport and tax ID, and Krebs traces his forum handles - Pin, NeroWolfe and Putinkrab - through shared emails, an ICQ number and a reused password to accounts registered in his name.
Key Takeaway: Khoroshev allegedly kept 20 percent of every ransom paid, and the trail that connected his personas was built from ordinary artifacts - a reused password, a phone number in domain records, an email on a social media account - the same kind of residue that accumulates around any long-running operator.
Read the original at Krebs on Security ↗
- Topics
- Ransomware
- Related
- Ransomware Defense Using the Wazuh Open Source Platform Cyber Risks ·