Loading story…
A Zurich District Court sentenced a 52-year-old Ukrainian IT specialist to 12 years and nine months in prison for serving as the lead developer of the LockerGoga, MegaCortex, and Nefilim ransomware families. The malware encrypted victim data for extortion campaigns that caused an estimated CHF 100 million (about EUR 106 million) in losses, including attacks on Swiss companies Stadler Rail, Meier Tobler, and Crealogix. Stadler Rail was targeted in May 2020 with a bitcoin ransom demand then valued at about USD 6 million.
The conviction followed an international investigation supported by France's anti-cybercrime office, which traced the operation through a France-hosted command-and-control server and ransom-payment flows. Investigators mapped infrastructure involving TrickBot and Cobalt Strike and helped enable release of a LockerGoga decryptor. The defendant denied involvement and may appeal; the court also imposed a 10-year ban from Switzerland. Prosecutors alleged an instigator had Russian-intelligence links, but the record did not establish that the convicted developer directly worked for Russian intelligence.
See the reporting duties and controls this puts on the clock.
6 events from the most recent confirmed update back to the earliest known activity.
A Zurich District Court sentenced the 52-year-old Ukrainian IT specialist to 12 years and nine months in prison for his key role in ransomware extortion operations, finding him to be the lead developer of LockerGoga, MegaCortex, and Nefilim. The court also imposed a 10-year ban from Switzerland; the judgment remains subject to appeal.
The alleged instigator of the ransomware operations reportedly died after falling from a window in Moscow. Prosecutors said he had allegedly cooperated with Russian secret services, though the court record contained no evidence of the defendant's direct links to those services.
Swiss authorities arrested the Ukrainian IT specialist following an international investigation supported by France's anti-cybercrime office. He was also subject to a French extradition request and remained in pre-trial detention.
Attackers targeted Swiss train manufacturer Stadler Rail, stole about 500 GB of confidential data, and demanded a bitcoin ransom valued at approximately USD 6 million. Stadler Rail refused to pay.
French energy-services company Spie and engineering consultancy Altran were targeted by the LockerGoga, MegaCortex, and Nefilim ransomware families.
French anti-cybercrime investigators identified a France-based command-and-control server rented by a Ukrainian national, traced ransom-payment flows to a suspect in Switzerland, and mapped infrastructure using TrickBot and Cobalt Strike. The international operation also led to publication of a LockerGoga decryptor.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A Zurich District Court sentenced a 52-year-old Ukrainian developer to **12 years and nine months** in prison for creating code used by the LockerGoga, MegaCortex, and Nefilim ransomware operations. The court also imposed a **10-year ban on entering Switzerland**, although the judgment remains subject to appeal. It found the defendant was a developer rather than the organizer of the criminal enterprises and rejected his claim that the source code recovered from his home was built for an unidentified cybersecurity-consulting client; extortion messages in his data helped undermine that defense. The conviction covered the developer's role in ransomware attacks including Nefilim's 2020 intrusion at Swiss rail manufacturer Stadler Rail, as well as attacks on Meier Tobler and Crealogix. U.S. authorities have separately indicted alleged operation mastermind Volodymyr Tymoshchuk, who remains at large, is listed by the FBI as wanted, and is associated with an **$11 million** reward offer.
Sep 18, 2026
Swiss prosecutors have asked a court to sentence a 52-year-old Ukrainian software developer to 12 years in prison for allegedly helping run ransomware attacks tied to **LockerGoga**, **MegaCortex**, and **Nefilim**. The case alleges he participated in intrusions, data theft, and system encryption used to extort at least 10 companies in Switzerland and other countries between late 2018 and mid-2020, causing estimated losses of more than **130 million Swiss francs**. Named victims include **Stadler Rail**, **Crealogix**, and **Meier Tobler**, and prosecutors are also seeking his expulsion from Switzerland for 12 years and the recovery of **1.8 million Swiss francs** in alleged criminal proceeds. The defendant denied creating malware or taking part in ransomware attacks, arguing that source code found on his devices came from legitimate consulting work for a cybersecurity client and disputing the integrity of seized digital evidence. The prosecution said the wider operation was directed by another Ukrainian hacker, **Oleksandr Ieremenko**, allegedly operating from Moscow and possibly benefiting from **FSB** protection, while stopping short of alleging direct Russian intelligence ties for the defendant. The investigation began after ransomware attacks in Zurich in 2019 and grew into a multinational law enforcement effort involving Switzerland, France, the Netherlands, Norway, Ukraine, and the United States.
Aug 22, 2026US federal prosecutors have indicted Ukrainian national Volodymyr Tymoshchuk for his alleged role as an administrator of the LockerGoga and MegaCortex ransomware operations. Tymoshchuk, also linked to the Nefilim group, is accused of extorting hundreds of companies worldwide between 2018 and 2021. The US State Department is offering up to $10 million for information leading to his arrest.
Jun 29, 2026