A 52-year-old Ukrainian national has been sentenced by the Zurich District Court to 12 years and nine months in prison for developing ransomware used in targeted attacks against multiple companies.
The court established that the man was the lead developer of the LockerGoga, MegaCortex and Nefilim encryption tools, although he was not the organizer of the criminal groups that deployed them. The malware was used against organizations in dozens of countries, with total damages from the examined incidents estimated at roughly 100 million Swiss francs.
One of the most prominent victims was Swiss train manufacturer Stadler Rail. In 2020 attackers stole approximately 500 GB of confidential data and demanded $6 million. The company refused to pay. Other affected entities included climate equipment supplier Meier Tobler and banking software developer Crealogix.
The defendant maintained that he had been engaged in ordinary information-security consulting and did not know how his code would be used. However, investigators recovered ransom-demand templates together with the malware source code, which the court found highly incriminating.
The man has been held in pre-trial detention since October 2021. His arrest formed part of a broader international investigation into ransomware operations that struck more than 1,800 citizens and organizations across 71 countries. After serving his sentence he will be prohibited from entering Switzerland for ten years. The verdict is not yet final and may be appealed.
