The Justice Department has arrested and charged a Russian national for his alleged role in multiple LockBit ransomware attacks against victims in the U.S. and around the world.

According to a criminal complaint unsealed on Thursday, 20-year-old Ruslan Magomedovich Astamirov is accused of carrying out five cyberattacks between August 2020 and March 2023, four of which deployed the notorious LockBit ransomware.

“Astamirov allegedly participated in a conspiracy with other members of the LockBit ransomware campaign to commit wire fraud and to intentionally damage protected computers and make ransom demands through the use and deployment of ransomware,” the Justice Department said.

Astamirov, a citizen of the Russian-controlled Chechen Republic, allegedly carried out attacks on two U.S.-based organizations, along with organisations headquartered in Japan, France and Kenya. According to the complaint, at least one of the victims paid $700,000. Another victim refused to pay, and Astamirov allegedly uploaded the company’s data to LockBit’s public server.

LockBit first emerged as a ransomware-as-a-service (RaaS) operation in late-2019 and has since been used in approximately 1,800 ransomware attacks against victim systems in the United States and worldwide. In an advisory published this week, U.S. cybersecurity officials said that known LockBit attacks accounted for 16% of attacks on public entities, including schools, local governments and law enforcement agencies, in 2022. 

Since January 2020, the LockBit group has been associated with approximately $91 million in ransoms paid in the U.S., the advisory said.

Astamirov, who was located and arrested in the U.S. after law enforcement traced a portion of a victim’s ransom payment to a cryptocurrency address under Astamirov’s control, has been indicted on charges of conspiracy to transmit ransom demands, commit wire fraud, and intentionally damage protected computers. If found guilty, he could face up to 20 years in prison for the wire fraud charge and up to five years in prison for the charge related to damaging protected computers.

Astamirov is the third LockBit affiliate the U.S. Justice Department has charged in the last seven months. In November, officials charged 33-year-old Mikhail Vasiliev – described as “one of the world’s most prolific ransomware operators” – for his alleged involvement in the LockBit ransomware gang. Vasiliev is now in custody in Canada and awaiting extradition to the United States.

In May, the U.S. government also indicted U.S. Mikhail Matveev, known online as “Wazawaka” and “Boriselcin,” for allegedly acting as a “central figure” in developing and deploying the Hive, LockBit and Babuk ransomware variants.

Since it emerged in 2019, LockBit has claimed multiple high-profile victims worldwide in recent months, including the U.K. postal giant Royal Mail, the government of Costa Rica, and financial software firm Ion Group. This week, LockBit also claimed responsibility for a cyberattack on Indian pharmaceutical giant Granules India and published portions of the data it allegedly stole.