“LockerGoga,” “MegaCortex,” and “Nefilim” Ransomware Administrator Charged with Ransomware Attacks

A Ukrainian national, Volodymyr Viktorovich Tymoshchuk, also known as deadforz, Boba, msfv and farnetwork, has been charged by the U.S. District Court for the Eastern District of New York with administering LockerGoga, MegaCortex and Nefilim ransomware operations.

According to the Department of Justice, Office of Public Affairs, Tymoshchuk is charged for his role in schemes that extorted more than 250 companies in the United States and hundreds more worldwide, with some attacks disrupting business operations until recovery of encrypted data. Between December 2018 and October 2021, he allegedly encrypted networks across several countries and customised ransomware for individual victims to yield unique decryption keys.

From July 2019 to June 2020, prosecutors say he and co-conspirators compromised more than 250 U.S. victims and hundreds abroad, and from July 2020 to October 2021 he was an administrator of the Nefilim strain, providing access to affiliates in exchange for a share of ransom proceeds.

The case notes that in September 2022, decryption keys for LockerGoga and MegaCortex were released via the No More Ransomware Project to help victims recover without paying, and the FBI and international partners continue to pursue the defendants.