US Charges Ransomware Criminal Who Targeted Hundreds of Firms Across the World As State Department Offers $11,000,000 Reward

A Ukrainian national is facing charges for allegedly playing a central role in ransomware schemes that impacted hundreds of US companies, according to a newly unsealed indictment.

The U.S. Department of Justice (DOJ) accuses Volodymyr Viktorovich Tymoshchuk, who is also known as deadforz, Boba, msfv, and farnetwork, of being the administrator of the ransomware variants LockerGoga, MegaCortex and Nefilim.

Says Joseph Nocella Jr., U.S. attorney for the Eastern District of New York,

“Tymoshchuk is a serial ransomware criminal who targeted blue-chip American companies, healthcare institutions, and large foreign industrial firms, and threatened to leak their sensitive data online if they refused to pay.

For a time, the defendant stayed ahead of law enforcement by deploying new strains of malicious software when his old ones were decrypted. [The] charges reflect international coordination to unmask and charge a dangerous and pervasive ransomware actor who can no longer remain anonymous.”

The U.S. Department of State’s Transnational Organized Crime (TOC) Rewards Program is offering up to $11 million for information leading to Tymoshchuk’s arrest.

Between December 2018 and October 2021, Tymoshchuk allegedly used the LockerGoga, MegaCortex, and Nefilim ransomware variants to encrypt computer networks in the US and other countries.

According to the indictment, the ransomware attacks caused millions of dollars of losses.

The scheme involved customizing a ransomware executable file for each ransomware victim and the creation of a decryption key that could only decrypt the network of the specific victim. If a ransom demand was paid, the perpetrators allegedly sent a decryption tool to allow the victim to decrypt the locked computer files.

Tymoshchuk and his accomplices are alleged to have attacked more than 250 companies in the United States alone, and hundreds more companies in other countries, including France, Germany and Norway.

Tymoshchuk is charged with two counts of conspiracy to commit fraud and related activity in connection with computers, three counts of intentional damage to a protected computer, one count of unauthorized access to a protected computer and one count of transmitting a threat to disclose confidential information.