Swiss prosecutors say a Ukrainian software developer helped build and run ransomware attacks that hit companies in Switzerland and other countries, and they are seeking a 12-year prison sentence. The case centers on alleged involvement in LockerGoga, MegaCortex, and Nefilim attacks between December 2018 and May 2020, with claimed losses of more than 130 million Swiss francs. Prosecutors say the defendant took part in attacks on 10 companies, including Stadler Rail, Crealogix, and Meier Tobler, and that the wider investigation involved authorities in Switzerland, France, the Netherlands, Norway, Ukraine, and the United States.
Why it matters: This is a significant enforcement case around several destructive ransomware families that caused major business disruption and extortion losses. It gives defenders and victims more concrete attribution around older but important ransomware campaigns and shows continued international pursuit of the people behind them.
2026.09.15
98% relevant
This is a direct update on the same Swiss criminal case: the previously charged alleged developer of LockerGoga, MegaCortex, and Nefilim has now been sentenced to 12 years and nine months, with the court also tying him to attacks including Stadler Rail, Meier Tobler, and Crealogix.
2026.08.17
100% relevant
This article establishes a distinct new story because it is a specific Swiss criminal trial over alleged development and operation of LockerGoga, MegaCortex, and Nefilim ransomware, not an update to an existing tracked event.
← Back to all stories