In a sprawling 26-count criminal indictment unsealed Tuesday morning, prosecutors allege that Khoroshev, 31, developed, promoted and oversaw the LockBit software, recruiting “affiliates” on cybercriminal forums who then carried out the actual ransomware attacks. Once a ransom was paid, typically in bitcoin (BTC), affiliates would give Khoroshev a 20% cut of their earnings, according to the indictment.
