The man allegedly wrote the code that powered the Lockergoga, MegaCortex, and Nefilim operations
A Swiss court has sentenced a 52-year-old Ukrainian ransomware developer to 12 years and nine months in prison for his role in attacks on companies including Stadler Rail.
Zurich District Court found that the man developed LockerGoga, MegaCortex, and Nefilim, but was not the mastermind behind the operations. He also received a ten-year ban from Switzerland. The judgment is not final and can be appealed.
He had been held in pretrial detention since October 2021 and consistently denied knowing that his software was being used for criminal purposes.
He said the source code found at his home in Basel-Landschaft came from his consulting work for a unidentified IT security client.
The court rejected that explanation because extortion messages were also found among his data, SWI reported.
The ransomware developer was also found guilty of playing a role in high-profile ransomware attacks, including the one that hit Stadler Rail in 2020 [PDF].
Not to be confused with the more recent attack on the rolling stock manufacturer – that one was claimed by Everest – the earlier breach occurred in May 2020.
At the time, Stadler Rail did not use the word "ransomware," but said the attack involved malware, that it "most likely led to a data leak," and that "the offenders tried to extort a large amount of money," threatening to leak the files if the ransom was not paid.
As it did following this year's incident, Stadler refused to pay. The 2020 Nefilim ransom demand was reportedly $6 million.
The court also found that he played a role in attacks on HVAC company Meier Tobler and software company Crealogix.
In September 2022, Zurich prosecutors reported that a suspect had been arrested in Basel-Landschaft in October 2021 on suspicion of money laundering and data corruption.
The statement accused the perpetrators of involvement in attacks on more than 1,800 individuals and institutions across 71 countries, causing estimated losses of several hundred million Swiss francs.
The same law enforcement action in 2021 led to the identification of other alleged members of the three ransomware operations, none of whom were named.
Volodymyr Tymoshchuk was formally indicted in the US last year and was described by prosecutors as the mastermind of all three ransomware crews.
Unlike many others, Tymoshchuk has not yet been arrested, but is on the FBI's most wanted list, with an $11 million bounty placed on the information that could lead to his arrest or conviction, or that of other leaders.
He was allegedly responsible for attacks on at least 250 companies, including the Norsk Hydro attack in 2019. ®