Loading story…
US federal prosecutors have indicted Ukrainian national Volodymyr Tymoshchuk for his alleged role as an administrator of the LockerGoga and MegaCortex ransomware operations. Tymoshchuk, also linked to the Nefilim group, is accused of extorting hundreds of companies worldwide between 2018 and 2021. The US State Department is offering up to $10 million for information leading to his arrest.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Department of Justice has charged Volodymyr Viktorovich Tymoshchuk, a Ukrainian national, for his central role in administering the LockerGoga, MegaCortex, and Nefilim ransomware operations. Tymoshchuk and his accomplices allegedly targeted over 250 companies in the U.S. and hundreds more globally, causing millions in damages. He remains a fugitive, with the U.S. State Department offering up to $11 million for information leading to his arrest or conviction.
Jun 29, 2026Ukrainian national Tymoshchuk Volodymyr Viktorovych has been named a high-priority fugitive for his role in major ransomware attacks, including LockerGoga, MegaCortex, and Nefilim. Authorities across Europe and the US are seeking public assistance, with the US DOJ offering up to $11 million for information leading to his capture. Tymoshchuk is accused of orchestrating attacks that caused over $18 billion in damages worldwide between 2018 and 2021.
Jun 29, 2026
Artem Aleksandrovych Stryzhak, a Ukrainian national, pleaded guilty to conspiracy to commit computer fraud for his role in deploying Nefilim ransomware against high-revenue companies in the United States and other countries. Stryzhak and his co-conspirators generated unique ransomware executables, decryption keys, and ransom notes for each victim, targeting organizations with annual revenues exceeding $100 million and threatening to publish stolen data unless ransoms were paid. He was arrested in Spain in June 2024 and extradited to the United States, where he faces up to 10 years in prison. Authorities are still seeking his alleged co-conspirator, Volodymyr Tymoshchuk, and have announced an $11 million reward for information leading to his arrest or conviction. The Nefilim ransomware group, for which Stryzhak operated, caused millions of dollars in losses through extortion payments and damage to victim networks. The group primarily targeted companies in the United States, Canada, and Australia, conducting research on potential victims to maximize the impact of their attacks. The U.S. Department of Justice highlighted the international scope of the operation and the significant financial and reputational harm inflicted on victim organizations. Stryzhak’s guilty plea marks a significant development in ongoing efforts to disrupt major ransomware operations and bring perpetrators to justice.
Jun 29, 2026