An alleged Ukrainian ransomware hacker's indictment in New York was unsealed Tuesday, while the State Department offered up to $11 million in rewards.
Sept. 9 (UPI) -- An alleged Ukrainian ransomware hacker's indictment in New York was unsealed Tuesday, while the U.S. Department of State offered up to $11 million in rewards for information leading to his arrest and the arrests of his associates.
Volodymyr Viktorovych Tymoshchuk, also known as "deadforz," "Boba," "msfv" and "farnetwork," is a Ukrainian national accused of several ransomware schemes around the world, a press release from the U.S. Attorney's Office, Eastern District of New York, said Tuesday.
"Tymoshchuk is a serial ransomware criminal who targeted blue-chip American companies, healthcare institutions, and large foreign industrial firms, and threatened to leak their sensitive data online if they refused to pay," said Joseph Nocella Jr., U.S. attorney for the Eastern District of New York, in a statement. "For a time, the defendant stayed ahead of law enforcement by deploying new strains of malicious software when his old ones were decrypted. Today's charges reflect international coordination to unmask and charge a dangerous and pervasive ransomware actor who can no longer remain anonymous."
The Department of State's Bureau of International Narcotics and Law Enforcement Affairs announced a reward offer of up to $10 million under the Transnational Organized Crime Rewards Program for information leading to the arrest or conviction, in any country, of Tymoshchuk.
INL also announced a separate reward offer of up to $1 million for information leading to the arrests or convictions of other key leaders of the Nefilim, LockerGoga, and MegaCortex ransomware variants.
According to the indictment, from December 2018 to October 2021, Tymoshchuk and other co‑conspirators used the ransomware to encrypt computer networks and deploy attacks against hundreds of victim company networks in the United States, France, Germany, the Netherlands, Norway and Switzerland.
The indictment charges Tymoshchuk with seven counts relating to his ransomware activity. He is a fugitive.
As of 2025, nearly 63 percent of businesses worldwide were affected by ransomware attacks, according to Statista's April 2025 report. That number was a decrease, with the highest number at 73% in 2023. Overall, since 2018, more than half of the total Statista survey respondents each year said that their organizations had been victimized by ransomware.