Ruslan Magomedovich Astamirov, LockBit Ransomware Attacks, New Jersey 2023

A 20-year-old Russian national from the Chechen Republic has been arrested and charged with conspiring to commit LockBit ransomware attacks against U.S. and foreign businesses.

Ruslan Magomedovich Astamirov allegedly participated in a conspiracy with other members of the LockBit ransomware campaign to commit wire fraud and to intentionally damage protected computers and make ransom demands through the use and deployment of ransomware.

The attacks, which occurred from at least August 2020 to March 2023, targeted victim computer systems in the United States, Asia, Europe, and Africa, resulting in over $100 million in ransom demands and tens of millions of dollars in actual ransom payments made in the form of bitcoin.

Astamirov directly executed at least five attacks against victim computer systems in the United States and abroad. He owned, controlled, and used a variety of email addresses, Internet Protocol (IP) addresses, and other online provider accounts that allowed him and his co-conspirators to deploy LockBit ransomware and to communicate with their victims.

The LockBit ransomware variant first appeared around January 2020, and LockBit actors have executed over 1,400 attacks against victims in the United States and around the world. The FBI is committed to pursuing ransomware actors like Astamirov, who have exploited vulnerable cyber ecosystems and harmed victims.

Astamirov is charged with conspiring to commit wire fraud and conspiring to intentionally damage protected computers and to transmit ransom demands. If convicted, he faces a maximum penalty of 20 years in prison on the first charge and a maximum penalty of five years in prison on the second charge. Both charges are also punishable by a maximum fine of either $250,000 or twice the gain or loss from the offense, whichever is greatest.

This is the second LockBit-related arrest in six months, and the third defendant charged by this office in the LockBit global ransomware campaign. The case is a reminder that cybercriminals may continue to run, but they cannot hide behind imagined online anonymity.

Related Federal Cases