Khoroshev has allegedly had involvement in LockBit since it first emerged in September 2019. Over the years, LockBit ransomware attacks have claimed over 2,500 victims in at least 120 countries, with Khoroshev and other co-conspirators allegedly collecting at least $500 million in ransom payments.

In February, US and UK law enforcement seized the websites and servers used by LockBit and even obtained the keys they could use to help organizations regain access to their data. At the time, it also charged Artur Sungatov and Ivan Kondratyev with deploying LockBit against victims in the US.

Khoroshev allegedly took 20 percent of each ransom payment extorted from victims and also operated the group’s data leak site. Law enforcement found that Khoroshev kept victims’ stolen data even after the group “falsely promised” it would delete the information when receiving a payment.

“Today’s indictment marks a significant milestone in the investigation and prosecution of LockBit, which has already led to charges against five other LockBit affiliates — two of whom are in custody awaiting trial — and a major disruption of the now discredited LockBit operation,” US Attorney Philip R. Sellinger for the District of New Jersey says in a statement.

Khoroshev faces 26 charges — including one count of conspiracy to commit fraud and eight counts of extortion to damage to a protected computer — and up to 185 years in prison. In addition to sanctioning Khoroshev, the feds are offering a $10 million reward for information that helps law enforcement apprehend him.