3C-INT logo [Cyber]Crime Characterization for Intelligence FREE PREVIEW
You are exploring the Free preview. To unlock full read-only access to all public profiles and in-app notifications, create a free research account. For analyst / premium plans capabilities (editing, advanced tabs, exports), please contact us

Threat Actor Characterization

Back
You’re viewing the read-only version. Sign in for analyst tools (editors, promote draft, file/relations management, etc.)
Dmitry Yuryevich Khoroshev

Dmitry Yuryevich Khoroshev

ID: 7bf420a464415da237ac534154a1487a02003
Cybercrime Cybercriminal Ransomware Affiliate
Threat types: Ransomware, RaaS, Intrusion
Russia
Updated: 2026-03-14
Created: 2026-03-04
Progress: 77% Completeness: 80% Freshness: 70%
Operation zone: —
Aliases Limited alias preview
DMITRII YURYEVICH KHOROSHEV DMITRIY YUREVICH KHOROSHEV Dm************************* Dm**************
Dm************************ DM************** Dm************** Dm************************
Kh******* Lo********* ДМ********************* —
Showing 2 of 11 aliases in free preview.
Actor Network Graph
Open Network Graph
Read-only preview for anonymous visitors. Sign in with a free Research account for full workspace.
MITRE ATT&CK®
confidence: medium
Actor Techniques page ATT&CK® Diagram

Dmitry Yuryevich Khoroshev is publicly identified by UK NCA and U.S. authorities as the alleged administrator/lead developer of LockBit RaaS (alias 'LockBitSupp'), with an unsealed U.S. indictment and coordinated sanctions announced on 2024-05-07.


Technique Technique name Tactics Evidence
T1585 Establish Accounts TA0042
  • 2024-05-07 — OFAC SDN entry lists alias 'LOCKBITSUPP' as an identifier for Khoroshev. · ref
T1587 Develop Capabilities TA0042
  • 2024-05-07 — INFERENCE (confidence: medium): DOJ describes a RaaS affiliate model; this implies provisioning of tooling/capability to affiliates as part of program operations. · ref
T1486 Data Encrypted for Impact TA0040
  • 2024-05-07 — INFERENCE (confidence: medium): LockBit is ransomware; Khoroshev is alleged developer/administrator (role-level evidence). · ref
Strategic Intelligence
Limited preview
Last updated: 2026-03-04T19:48:32+00:00

Dmitry Yuryevich Khoroshev - Alleged RaaS administrator/developer (LockBit) — leadership persona

Classification: Unclassified / Open Source Intelligence (OSINT) — TLP:WHITE

Full strategic intelligence is available in Analyst and Premium plans.
Executive Analyst Brief for CISO
Saved Limited preview

Executive Analyst Brief for Decision Makers — Dmitry Yuryevich Khoroshev

Classification: Unclassified / OSINT — TLP:WHITE

Upgrade to access the full executive brief.
Tip: Hover the section title to learn what’s included in Analyst / Premium plans.
Executive brief now
Saved successfully.
Hunting Playbook
Saved Limited preview

Hunting Playbook — LockBit ecosystem (leadership anchor: “LockBitSupp”)


Upgrade to access the full hunting playbook.
Tip: Hover the section title to learn what’s included in Analyst / Premium plans.
Hunting Playbook now
Saved successfully.
IOC Appendix
Saved Limited preview
Last updated: 2026-03-05T21:21:36+00:00

IOC Appendix — LockBit ecosystem (leadership anchor: Dmitry Yuryevich Khoroshev)

Classification: Unclassified / OSINT — TLP:WHITE

More IOC context for Research. Full appendix for Analyst and Premium plans.
IOC Appendix now
Saved successfully.
OSINT Library
Saved Limited preview
Last saved: 2026-03-04T19:50:37+00:00

OSINT Library — Dmitry Yuryevich Khoroshev (LockBit)


2024-05-07 — UK National Crime Agency (NCA) — “LockBit leader unmasked and sanctioned”

Full OSINT references available for Research / Analyst.
OSINT Library now
Saved successfully.
Social Medial & Communication
SOCMINT integrated: 0/3
Address Verification SOCMINT
kh********@icloud.com Restricted Not integrated
si******@yandex.ru Restricted Not integrated
Address Verification SOCMINT
www.state.gov/tra****************************************************************************************************** Restricted Not integrated
Notes: preview mode hides sensitive social/contact details.
Reference Images/Associated Evidence Limited
Showing 1–2 of 2 images
Reference image Free Preview
Reference image
Reference image Free Preview
Reference image