Volodymyr Tymoshchuk

Introduction

Volodymyr Viktorovych Tymoshchuk is a Ukrainian national, born October 2, 1996, whom federal prosecutors charge with serving as an administrator of the LockerGoga, MegaCortex, and Nefilim ransomware strains — the alias-carrying operator accused of extorting companies on both sides of the Atlantic for nearly three years. A superseding indictment in the Eastern District of New York was unsealed on September 9, 2025, and he is not in U.S. custody. The State Department is offering up to $10 million for information leading to his arrest or conviction, and he has not been located. This page’s date marks July 2020, the point when, per the indictment, his alleged role shifted from deploying earlier strains to administering Nefilim.

Background Information

The State Department’s wanted profile lists Tymoshchuk’s date of birth as October 2, 1996, his place of birth as Ukraine, and his nationality and citizenship as Ukrainian, along with the aliases “Deadforz,” “Boba,” “msfv,” and “farnetwork.” The May 2024 superseding indictment charged him with conspiracy to commit fraud and related activity in connection with computers, intentional damage to a protected computer, unauthorized access to a protected computer, and transmitting a threat to disclose confidential information. The Eastern District of New York’s announcement lists him as 28 years old and of Kiev, Ukraine, under docket number 23-CR-324, with the case handled by the office’s National Security and Cybercrime Section. Nefilim, the strain he is alleged to have later administered, ran as a “ransomware as a service” enterprise: administrators built the tool and leased it to affiliates for a cut of what they extorted.

The Controversy or Incident That Led to Their Cancellation

Charged, not tried — remains a fugitive. The conduct described here is alleged in an unsealed federal indictment. Tymoshchuk has not been located, has faced no trial, and has entered no plea; he is presumed innocent unless and until proven guilty.

As alleged in the superseding indictment, between December 2018 and October 2021 Tymoshchuk used the three variants to encrypt computer networks in countries around the world, including in the Eastern District of New York, elsewhere in the United States, France, Germany, the Netherlands, Norway, and Switzerland, causing millions of dollars of losses through system damage, remediation costs, and ransom payments. The attacks followed a set pattern: customize the ransomware file for each victim, lock the network, and send a decryption tool only after the ransom was paid. Between July 2019 and June 2020, he and his co-conspirators are alleged to have compromised the networks of more than 250 victim companies in the United States and hundreds of other companies around the world with LockerGoga and MegaCortex — though many of those extortion attempts failed because law enforcement often notified victims that their networks had been compromised before the ransomware could be deployed.

From approximately July 2020 through October 2021 — the period this page is dated to — Tymoshchuk is alleged to have been one of the administrators of Nefilim. In that role he gave affiliates, including co-defendant Artem Stryzhak, access to the Nefilim ransomware “panel” in exchange for 20 percent of the ransom proceeds they collected. The indictment alleges he preferred targets in the United States, Canada, or Australia with more than $100 million in annual revenue, and that in one exchange with Stryzhak in or about July 2021 he encouraged targeting companies with more than $200 million. Nefilim actors stole data and threatened to publish it on “Corporate Leaks” websites unless victims agreed to pay. U.S. Attorney Joseph Nocella Jr. called him “a serial ransomware criminal who targeted blue-chip American companies, health care institutions, and large foreign industrial firms, and threatened to leak their sensitive data online if they refused to pay.” “For a time, the defendant stayed ahead of law enforcement by deploying new strains of malicious software when his old ones were decrypted,” Nocella said.

Public Reaction and Consequences

The unsealing was engineered for volume. Acting Assistant Attorney General Matthew R. Galeotti said Tymoshchuk “is charged for his role in ransomware schemes that extorted more than 250 companies across the United States and hundreds more around the world,” and Nocella framed the charges as unmasking “a dangerous and pervasive ransomware actor who can no longer remain anonymous.” The same day, the State Department announced reward offers totaling up to $11 million — up to $10 million for Tymoshchuk under the Transnational Organized Crime Rewards Program, plus a separate offer of up to $1 million for other key leaders of the three variants — in a press statement that notes plainly, “Tymoshchuk remains a fugitive.” The announcement was coordinated with the Justice Department, the FBI, Europol, and partners in Germany, France, and Norway, and tips are directed to the FBI at +1-917-242-1407 or [email protected]. A further consequence had already landed on the strains themselves: in September 2022, decryption keys for LockerGoga and MegaCortex were released through the “No More Ransomware Project,” letting victims recover data without paying.

Current Status

Tymoshchuk remains a fugitive: no trial date, no plea, and no announced location. The Justice Department’s own caveat governs the case: “An indictment is merely an allegation. All defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.” The one co-defendant named with him has been accounted for — Artem Stryzhak was extradited from Spain in April 2025, pleaded guilty in December 2025, and was sentenced to 70 months in prison on October 27, 2026. At that sentencing, Nocella said, “We remain determined to capture Volodymyr Tymoshchuk, a serial ransomware developer and Stryzhak’s co-conspirator,” and by then the reward offer for information on Tymoshchuk stood at up to $11 million.

Impact on Their Career/Life

Tymoshchuk’s alleged career was the criminal enterprise itself, and its arc ran from anonymity to exposure: a man who prosecutors say reinvented his malware each time defenders caught up is now publicly attached to his aliases via a wanted profile with posters in English, Russian, and Ukrainian, and a reward of up to $10 million for information leading to his arrest and conviction in any country. For the more than 250 U.S. companies and hundreds of others worldwide caught in the alleged LockerGoga and MegaCortex waves, the documented costs were system damage, remediation, and ransoms; for health care institutions, disruption while data and systems were held hostage. What his record still lacks is any courtroom accounting — no trial, no plea, no sentence — and until he is found, his story ends where the unsealed indictment does.

Sources

U.S. Department of Justice, Office of Public Affairs, “‘LockerGoga,’ ‘MegaCortex,’ and ‘Nefilim’ Ransomware Administrator Charged with Ransomware Attacks,” September 9, 2025 — source
U.S. Attorney’s Office, Eastern District of New York, “Ransomware Administrator Charged with Cybercrimes for Deploying ‘Lockergoga,’ ‘Nefilim,’ and ‘Megacortex’ Ransomware Strains Against Hundreds of Victims,” September 9, 2025 — source
U.S. Department of State, “Volodymyr Viktorovych Tymoshchuk,” September 9, 2025 — source
U.S. Department of State, Office of the Spokesman, “Reward Offers Totaling up to $11 Million for Information Leading to Arrests and/or Convictions of Ukrainian Malicious Cyber Actor and Other Unknown Ransomware Key Leaders,” September 9, 2025 — source
U.S. Department of Justice, Office of Public Affairs, “Ukrainian National Sentenced for Role in Hacking Hospitals, Businesses, and Governments as Part of Ransomware Conspiracies Causing Over $100 Million In Losses,” October 27, 2026 — source