Volodymyr Tymoshchuk, a Ukrainian national infamously known under pseudonyms like "deadforz" and "Boba," is now facing charges for masterminding widespread ransomware attacks. The U.S. Department of Justice reports that Tymoshchuk's digital siege spanned the globe, distributing the feared "LockerGoga," "Nefilim," and "Megacortex" ransomware strains and targeting an array of sectors, from blue-chip firms to healthcare providers.
In a statement obtained by the U.S. Attorney's Office for the Eastern District of New York, U.S. Attorney Joseph Nocella, Jr. described Tymoshchuk’s operation as a menacing cyber presence that for a period outpaced authorities. "Today’s charges reflect international coordination to unmask and charge a dangerous and pervasive ransomware actor who can no longer remain anonymous," Nocella said.
An international effort between December 2018 and October 2021 implicated Tymoshchuk in attacks across six European countries and numerous states within the U.S., including the Eastern District of New York. These incidents incurred tens of millions in damages and ransom payments, with the cyberattacks locking files and demanding payment for their release. The superseding indictment details Tymoshchuk's intricate methodologies—utilizing tools to exploit vulnerabilities, perform brute-force password attacks, and even purchase compromised network credentials.
According to the indictment, Tymoshchuk not only orchestrated large-scale encryption attacks but also extracted sensitive information from victim networks. In instances where victims resisted payment, data would be threatened with exposure on a "Corporate Leaks" website operated by the Nefilim affiliates. Co-defendant Artem Stryzhak, currently awaiting trial, is alleged to have paid Tymoshchuk a 20 percent cut of the ransoms he collected.
As a continuing effort to reign in the cybercrime wave, the U.S. State Department TOC Rewards Program has offered a reward of up to $11 million for information that could lead to the arrest, conviction, or location of Tymoshchuk or his co-conspirators. Tips can be relayed to the FBI by calling +1-917-242-1407, emailing [email protected], or via local FBI field offices and U.S. embassies globally for those outside American borders.
The pursuit of accountability is supported by the Department of Justice's Office of International Affairs, FBI Legal Attachés, and law enforcement from nine European countries alongside Europol and Eurojust.
