Loading story…
Swiss prosecutors have asked a court to sentence a 52-year-old Ukrainian software developer to 12 years in prison for allegedly helping run ransomware attacks tied to LockerGoga, MegaCortex, and Nefilim. The case alleges he participated in intrusions, data theft, and system encryption used to extort at least 10 companies in Switzerland and other countries between late 2018 and mid-2020, causing estimated losses of more than 130 million Swiss francs. Named victims include Stadler Rail, Crealogix, and Meier Tobler, and prosecutors are also seeking his expulsion from Switzerland for 12 years and the recovery of 1.8 million Swiss francs in alleged criminal proceeds.
The defendant denied creating malware or taking part in ransomware attacks, arguing that source code found on his devices came from legitimate consulting work for a cybersecurity client and disputing the integrity of seized digital evidence. The prosecution said the wider operation was directed by another Ukrainian hacker, Oleksandr Ieremenko, allegedly operating from Moscow and possibly benefiting from FSB protection, while stopping short of alleging direct Russian intelligence ties for the defendant. The investigation began after ransomware attacks in Zurich in 2019 and grew into a multinational law enforcement effort involving Switzerland, France, the Netherlands, Norway, Ukraine, and the United States.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
At the Zurich trial, prosecutors identified Stadler Rail, Crealogix, and Meier Tobler among the 10 companies allegedly targeted by the LockerGoga, MegaCortex, and Nefilim ransomware operation. The named attacks were part of the broader campaign prosecutors say caused more than 130 million Swiss francs in losses.
Prosecutors said alleged attack director Oleksandr Ieremenko died after falling from a window in Moscow in 2022. They said they could not determine whether the death was an accident, suicide, or killing.
The defendant in the Swiss ransomware case has been in custody since October 2021. Prosecutors accuse him of playing a key role in attacks tied to LockerGoga, MegaCortex, and Nefilim.
Swiss authorities launched an investigation after ransomware attacks against companies in Zurich in 2019. The case later expanded into an international operation involving authorities in Switzerland, France, the Netherlands, Norway, Ukraine, and the United States.
Zurich prosecutors alleged that a cybercriminal group, with the defendant as a direct participant, attacked 10 companies in Switzerland and other countries using LockerGoga, MegaCortex, and Nefilim. The alleged attacks occurred between December 2018 and May 2020 and caused more than 130 million Swiss francs in losses.
In closing arguments at the Zurich District Court trial, the prosecutor said the malware attacks against Western companies fit a deliberate Russian strategy to cause disruption and targeted damage. He also said the alleged mastermind cooperated with the FSB, while the indictment did not establish a direct link between the defendant and Russian intelligence services.
The 52-year-old Ukrainian software developer went on trial in Zurich District Court on Monday, where prosecutors sought a 12-year prison sentence, expulsion from Switzerland for 12 years, and recovery of 1.8 million Swiss francs in alleged criminal proceeds. The defendant denied developing malware or participating in ransomware attacks and challenged the integrity of seized digital evidence.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcecyberveille.ch
Open sourcebluewin.ch
Open sourcetherecord.media
Open sourcewatson.ch
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Artem Aleksandrovych Stryzhak, a Ukrainian national, pleaded guilty to conspiracy to commit computer fraud for his role in deploying Nefilim ransomware against high-revenue companies in the United States and other countries. Stryzhak and his co-conspirators generated unique ransomware executables, decryption keys, and ransom notes for each victim, targeting organizations with annual revenues exceeding $100 million and threatening to publish stolen data unless ransoms were paid. He was arrested in Spain in June 2024 and extradited to the United States, where he faces up to 10 years in prison. Authorities are still seeking his alleged co-conspirator, Volodymyr Tymoshchuk, and have announced an $11 million reward for information leading to his arrest or conviction. The Nefilim ransomware group, for which Stryzhak operated, caused millions of dollars in losses through extortion payments and damage to victim networks. The group primarily targeted companies in the United States, Canada, and Australia, conducting research on potential victims to maximize the impact of their attacks. The U.S. Department of Justice highlighted the international scope of the operation and the significant financial and reputational harm inflicted on victim organizations. Stryzhak’s guilty plea marks a significant development in ongoing efforts to disrupt major ransomware operations and bring perpetrators to justice.
Jun 29, 2026
Belarusian national **Maksim Silnikau** was sentenced in federal court in Alexandria, Virginia, to **16 years in prison** for creating and operating the **Ransom Cartel** ransomware-as-a-service operation. U.S. prosecutors said Silnikau launched the scheme in **May 2021**, later rebranding it as Ransom Cartel, and recruited affiliates through underground Russian-language forums while seeking access to non-CIS corporate networks. He allegedly supplied stolen credentials, encryption tools, and a hidden management panel, and coordinated attacks and ransom negotiations through infrastructure he controlled. Authorities said Ransom Cartel affiliates attacked at least **18 companies** in the United States and abroad between **2021 and 2023**, stealing corporate data and attempting to extort at least **$5.2 million**, with known victim losses exceeding **$6.7 million**. Prosecutors also said Silnikau worked with initial access brokers and laundered ransom proceeds through cryptocurrency mixers. He was arrested in Spain in 2023, briefly fled while awaiting extradition, was later captured near the Poland-Belarus border, and extradited to the United States; a separate federal case in New Jersey tied to the **Angler Exploit Kit** and co-defendants **Volodymyr Kadariya** and **Andrei Tarasov** remains pending.
Aug 15, 2026The U.S. Department of Justice has charged Volodymyr Viktorovich Tymoshchuk, a Ukrainian national, for his central role in administering the LockerGoga, MegaCortex, and Nefilim ransomware operations. Tymoshchuk and his accomplices allegedly targeted over 250 companies in the U.S. and hundreds more globally, causing millions in damages. He remains a fugitive, with the U.S. State Department offering up to $11 million for information leading to his arrest or conviction.
Jun 29, 2026