Australia bans alleged LockBit leader

A Russian citizen accused of heading global ransomware group LockBit has been hit with financial sanctions and banned from entering Australia.

The Federal Government said today Dmitry Khoroshev held a “senior leadership role” in the ransomware group.

LockBit works to destabilise and disrupt sectors of the economy for financial gain.

Its ransomware has been used against Australian, British and American businesses. LockBit was behind 18 per cent of total reported Australian ransomware incidents in the period 2022 to 2023 and targeted 119 people in the country, the government said.

During an international law enforcement operation in February, LockBit was initially disrupted when officers seized control of the group’s server and used it to spread details about the group and the people running it.

Operation Cronos, which involved the Australian Federal Police and the cyber espionage agency the Australian Signals Directorate, continues to investigate LockBit and disrupt its activities.

AFP Cyber Command Acting Assistant Commissioner Chris Goldsmid said by revealing his identity, Khoroshev had been dealt a blow to his credibility in the world of cybercriminals.

“Since 2019, LockBit has caused billions of dollars’ worth of harm across the globe, including millions of dollars lost by Australian individuals and businesses,” he said.

“In cooperation with international partners under Operation Cronos, the AFP has used information collected to trace the global LockBit network and build the global case against the ransomware criminal group.

The new sanction under the cyber sanctions framework makes it a criminal offence to provide assets to Khoroshev, or to use or deal with his assets.

He is the second alleged cyber criminal to be sanctioned by Australia. Last October, the Federal Government joined, the US and British governments in imposing penalties on Russian citizen Alexander Ermakov for his role in the cyber attack on health insurance provider Medibank Private.