Key Operators of LockerGoga, MegaCortex, and Nefilim Ransomware Gangs Arrested

According to the U.S. District Court for the Eastern District of New York, Volodymyr Viktorovich Tymoshchuk, a Ukrainian national known as deadforz, Boba, msfv and farnetwork, has been charged for his role in administering LockerGoga, MegaCortex and Nefilim ransomware operations.

The indictment alleges that Tymoshchuk managed attacks against more than 250 companies in the U.S. and hundreds of organisations globally, targeting high-profile American corporations, health care institutions and major foreign industrial firms, and that he threatened victims with data leaks if ransom payments were not made.

Authorities say he switched to newer variants after decryption tools were developed for earlier strains to avoid detection, and that from July 2020 onwards he was alleged to have been an administrator of Nefilim, granting affiliates such as co-defendant Artem Stryzhak access to the tool in exchange for 20 per cent of the ransoms.

The case notes that from December 2018 to October 2021 these ransomware campaigns breached networks in the United States, France, Germany, the Netherlands, Norway and Switzerland, with decryption keys later released in September 2022 through the No More Ransomware Project. A U.S. Department of State reward programme offers up to $11 million for information leading to arrests or convictions, and the FBI continues to investigate in cooperation with European and Ukrainian agencies.