US Offers $10 Million Reward for Ukrainian Ransomware Operator

The US on Tuesday announced a reward of up to $10 million for information on Volodymyr Viktorovich Tymoshchuk, a Ukrainian national indicted for administering the LockerGoga, MegaCortex and Nefilim ransomware families. The individual, also known as Boba, Deadforz, Farnetwork and Msfv, is accused of compromising networks of hundreds of organisations in the US and abroad to deploy ransomware and extort payments.

According to a May 2024 superseding indictment unsealed on 10 September 2025, the intrusions caused hundreds of millions of dollars in losses, including remediation costs, damage to computers and ransom payments. The indictment alleges the ransomware was customised per victim to create decryption keys specific to each organisation, and notes that decryptors were released publicly via the No More Ransomware Project to enable recovery without paying.

Between July 2019 and June 2020 Tymoshchuk and co-conspirators hit more than 250 US organisations and hundreds more abroad with LockerGoga and MegaCortex, including entities in several European countries; from July 2020 through October 2021 he was an administrator of Nefilim, providing access to others in exchange for 20% of payments.

According to the US Department of State, under the Transnational Organized Crime Rewards Program, rewards of up to $10 million are offered for information leading to the arrest and/or conviction of Tymoshchuk.