Today, the Department of State's Bureau of International Narcotics and Law Enforcement Affairs (INL) is announcing a reward offer of up to $10 million under the Transnational Organized Crime Rewards Program (TOCRP) for information leading to the arrest and/or conviction, in any country, of Ukrainian malicious cyber actor Volodymyr Viktorovych Tymoshchuk.
In addition, INL is also announcing a separate reward offer of up to $1 million for information leading to the arrests and/or convictions of other key leaders (other than Tymoshchuk and a known co-conspirator) of the Nefilim, LockerGoga, and MegaCortex ransomware variants.
According to a criminal indictment filed in Eastern District of New York (EDNY), from at least December 2018 to at least October 2021, Tymoshchuk and other co‑conspirators used the Nefilim, LockerGoga, and MegaCortex ransomware variants to encrypt computer networks and deploy ransomware schemes against hundreds of victim company network owners in the United States and other countries around the world. The ransomware schemes were costly to U.S. victims, both in ransom payments and mitigation costs.
Today's announcement was made in coordination with the Department of Justice, FBI, and Europol, and our partners in Germany, France, and Norway. The Department of Justice announced the unsealing of the superseding indictment, charging Tymoshchuk with seven counts relating to his ransomware activity. Tymoshchuk remains a fugitive.
