The Justice Department on Sept. 9 unsealed a 2024 indictment of Ukrainian hacker Volodymyr Viktorovych Tymoshchuk for his alleged role in exploiting hundreds of companies via ransomware schemes.
Tymoshchuk is alleged to be the administrator of the LockerGoga, MegaCortex, and Nefilim ransomware schemes that affected more than 250 U.S. companies and hundreds more in other countries, causing millions in damage.
“Tymoshchuk is a serial ransomware criminal who targeted blue-chip American companies, health care institutions, and large foreign industrial firms, and threatened to leak their sensitive data online if they refused to pay,” Eastern District of New York U.S. Attorney Joseph Nocella Jr. said in a statement.
“Tymoshchuk is charged with two counts of conspiracy to commit fraud and related activity in connection with computers, three counts of intentional damage to a protected computer, one count of unauthorized access to a protected computer, and one count of transmitting a threat to disclose confidential information.”
According to the indictment, victims who paid the ransoms were sent keys to decrypt their data, and those who didn’t had their data posted to “corporate leaks” websites. Tymoshchuk allegedly coordinated these operations.
An alleged coconspirator, Artem Stryzhak, was extradited from Spain in April to face charges in the United States.
Victims in the United States included a chemical company in Ohio from which the hackers extorted more than $1.8 million; an international eyewear company with computer servers in New York, which had 102 gigabytes of data leaked; and an oil and gas transportation company that had documents related to oil and gas deliveries, including customs documents, stolen.
Tymoshchuk at various times claimed that his operation made $100 million or $200 million in annual revenue, and he advertised his services and ransomware code in exchange for 20 percent of ransomware revenue.
The State Department’s Bureau of International Narcotics and Law Enforcement Affairs is offering $10 million under the Transnational Organized Crime Rewards Program for information leading to the arrest or conviction of Tymoshchuk and an additional $1 million for information leading to the arrest or conviction of other leaders in these ransomware schemes.
Tymoshchuk allegedly administered ransomware schemes between 2018 and 2021.
LockerGoga emerged in 2019; Norwegian company Norsk Hydro was one of its most high-profile victims. The attack affected 35,000 employees across 40 countries and ultimately cost about $71 million.
In 2021, LockerGoga and MegaCortex ransomware were used by a crime ring to target more than 1,800 entities in 71 countries. In October 2021, a dozen people were arrested in Ukraine and Switzerland on charges related to the ransomware ring.
In 2022, Romanian cybersecurity company Bitdefender joined law enforcement to release free keys to LockerGoga so that would-be victims could decrypt files without negotiating a ransom. Bitdefender also released keys to MetaCortex, which have been archived on the No More Ransom project between cybersecurity companies and law enforcement to provide free decryption keys for known ransomware.
Nefilim emerged in 2020 and has targeted large multinational companies.
Tymoshchuk’s indictment highlights the importance of international collaboration in cracking down on cybercrime and holding perpetrators accountable, U.S. authorities said.
The investigation involved Europol as well as authorities in France, the Czech Republic, Germany, Lithuania, Luxembourg, the Netherlands, Norway, Switzerland, and Ukraine.
“Today’s announcement should serve as warning, cyber criminals may believe they act with impunity while conducting harmful cyber intrusions, but law enforcement is onto you and will hold you accountable,” said Assistant Director in Charge Christopher G. Raia of the FBI New York Field Office.
“The FBI along with our law enforcement partners will continue to scour the globe to bring to justice any individual attempting to use the anonymity of the internet to commit crime.”
