Swiss court sentences 52-year-old Ukrainian ransomware dev to nearly 13 years in the cooler

A Swiss court has sentenced a 52-year-old Ukrainian ransomware developer to 12 years and nine months in prison for his role in attacks on companies including Stadler Rail.

Zurich District Court found that the man developed LockerGoga, MegaCortex, and Nefilim, but was not the mastermind behind the operations.

He also received a ten-year ban from Switzerland.

The judgment is not final and can be appealed.

He had been held in pretrial detention since October 2021 and consistently denied knowing that his software was being used for criminal purposes.

He said the source code found at his home in Basel-Landschaft came from his consulting work for an unidentified IT security client.

The court rejected that explanation because extortion messages were also found among his data, SWI reported.

The ransomware developer was also found guilty of playing a key role in high-profile ransomware attacks, including the one that hit Stadler Rail in 2020 [PDF].

Not to be confused with the more recent attack on the rolling stock manufacturer – that one was claimed by Everest – the earlier breach occurred in May 2020.

At the time, Stadler Rail did not use the word "ransomware," but said the attack involved malware, that it "most likely led to a data leak," and that "the offenders tried to extort a large amount of money," threatening to leak the files if the ransom was not paid.

As it did following this year's incident, Stadler refused to pay.

The 2020 Nefilim ransom demand was reportedly $6 million.

The court also found that he played a key role in attacks on HVAC company Meier Tobler and software company Crealogix.

In September 2022, Zurich prosecutors reported that a suspect had been arrested in Basel-Landschaft in October 2021 on suspicion of money laundering and data corruption.