lockergoga
LockerGoga is a ransomware strain linked to a cybercriminal group administered by Volodymyr Viktorovich Tymoshchuk (aliases: deadforz, Boba, msfv, farnetwork), a Ukrainian national currently wanted by U.S. and European authorities. LockerGoga was used in targeted ransomware attacks against over 250 companies in the United States and hundreds more globally, including blue-chip American companies, healthcare institutions, and large foreign industrial firms. The attacks caused millions of dollars in damages, including ransom payments and operational disruptions. LockerGoga operations involved customizing ransomware executables and decryption keys for each victim, with ransom demands in exchange for decryption tools. The group also administered other ransomware strains, notably MegaCortex and Nefilim, and operated an affiliate model, providing ransomware code to affiliates in exchange for a share of ransom proceeds. Law enforcement actions have led to the release of decryption keys and the arrest of some affiliates, but Tymoshchuk remains at large. There is no direct evidence of nation-state sponsorship; the group is financially motivated. Known sub-groups or closely linked operations include MegaCortex and Nefilim ransomware campaigns.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
LockerGoga is associated with ransomware operations targeting companies, with activities managed by individuals such as Tymoshchuk.
LockerGoga is associated with ransomware attacks that breached hundreds of companies worldwide, resulting in millions of dollars in damages.
LockerGoga is a ransomware strain linked to actors involved in the Nefilim group, used in attacks against corporate networks for extortion.
LockerGoga is a ransomware group responsible for attacks on hundreds of organizations globally, causing significant operational disruption and financial losses. The group customized ransomware payloads for each victim and demanded ransom for decryption.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.