Reported by 1 outlet

Timeline

1. original reporting

   LockerGoga/MegaCortex/Nefilim Developer Convicted in Switzerland, Ringleader Tymoshchuk Remains at Large

   insicurezzadigitale.com · 25d ago · September 18th, 2026

   LockerGoga, MegaCortex, Nefilim: Developer Convicted in Switzerland, But Ringleader Tymoshchuk Remains at Large

   A district court in Zurich has sentenced a 52-year-old Ukrainian citizen to 12 years and 9 months in prison, plus a 10-year ban on entering Switzerland, for his role in developing three of the most damaging ransomware families in recent years: LockerGoga, MegaCortex, and Nefilim. It is one of the harshest sentences ever imposed in Europe for a cybercrime, but the convicted man was not the mastermind. The true architect, Volodymyr Viktorovych Tymoshchuk, remains a fugitive on the FBI's wanted list with an $11 million bounty.

   The defendant, identified through OSINT sources as Artem Melnik, was arrested in October 2021 in the canton of Basel-Landschaft. Investigators found ransomware source code and extortion negotiation messages at his residence. The court determined his role was primarily technical, code development and maintenance, rather than organizational leadership, though this did not spare him one of the longest sentences ever imposed in Europe for such crimes. The verdict is appealable.

   The trial documented damage to over 1,800 individuals and organizations across 71 countries. Notable victims include Norsk Hydro, the Norwegian aluminum giant hit by LockerGoga in March 2019 in one of the most studied ransomware attacks in recent history. Norsk Hydro was forced to revert to manual processes and pen-and-paper at several facilities, with losses estimated in the tens of millions of dollars, and publicly chose not to pay the ransom, becoming a case study in incident response. Other victims listed in the Zurich trial include Swiss rail manufacturer Stadler Rail, hit in May 2020 with a $6 million ransom demand, HVAC company Meier Tobler, and fintech Crealogix.

   According to the US Department of Justice indictment filed in the Eastern District of New York, between December 2018 and October 2021 the group operated through a scheme that has since become standard in organized cybercrime: initial access via brute-force credential attacks, exploitation of known vulnerabilities, and purchases of pre-compromised access from Initial Access Brokers. Once inside a network, affiliates used additional tools for reconnaissance, persistence, lateral movement, and privilege escalation before exfiltrating data and deploying encryption payloads. Victims who refused to pay were threatened with data publication on "Corporate Leaks" portals, a double-extortion model that became the de facto standard in the ransomware ecosystem from 2019-2020 onward.

   From July 2020 the group operated Nefilim as a true ransomware-as-a-service platform, with Tymoshchuk as the administrator who provided access to affiliates in exchange for a percentage of successful attack proceeds. Targets were actively selected, prioritizing North American and Australian companies with revenue exceeding $100 million.

   via Mastodon https://insicurezzadigitale.com/lockergoga-megacortex-nefilim-condannato-in-svizzera-lo-sviluppatore-ma-il-capo-tymoshchuk-resta-latitante/

2. mentioned by insicurezzadigitale.com

   LockerGoga, MegaCortex, Nefilim: developer convicted in Switzerland, but ringleader Tymoshchuk remains at large

   insicurezzadigitale.com · 25d ago · September 19th, 2026