Ukrainian hacker jailed in Switzerland over ransomware attacks

The court found that the defendant had played a key role in cyberattacks against companies such as Stadler Rail, Meier Tobler and Crealogix with the aim of extorting ransoms. Keystone-SDA

A Ukrainian IT specialist was sentenced in Zurich to 12 years and nine months in prison and banned from Switzerland for ten years for his role in ransomware attacks on several firms, including Stadler Rail. Prosecutors put the damage at around CHF100 million ($123 million).

In its judgement handed down on Thursday, the Zurich District Court went further than the prosecution, which had sought a prison sentence of twelve years for the 52-year-old IT specialist. The man, who was living in canton Basel Country, has been in pre-trial detention since October 2021.

The court found that the defendant had played a key role in cyberattacks against companies such as Stadler Rail, Meier Tobler and Crealogix with the aim of extorting ransoms. He is regarded as the lead developer of the Lockergoga, Megacortex and Nefilim malware programmes, which were used to encrypt data belonging to the targeted companies.

During the attack on Stadler Rail, the defendant stole around 500 gigabytes of confidential data and threatened to publish it online. Stadler Rail refused to pay the ransom demanded. Other companies, however, accepted. In total, the losses incurred are estimated at CHF100 million.

Merely a “consultant”

The judge said the Ukrainian was not the mastermind behind the operations, but developed the malware and passed it on to instigators who remain unknown. These people then targeted companies in Switzerland and abroad and coordinated the extortion attempts.

The defendant has consistently denied being aware of the criminal use of his software. He maintained that he had simply been working as a consultant for an unknown client in the field of IT security, which was why the source codes had been found at his home. But the court did not believe him as extortion messages were also found among his data.

Mysterious death in Moscow

During the trial in August, certain revelations by the prosecution caused a stir. The accused’s alleged instigator is said to have cooperated with the Russian secret services before dying after falling from a window in Moscow in November 2022. He was reportedly a Ukrainian hacker, for whom the United States had offered a bounty, who was using a false identity provided by the Russian intelligence services.

The prosecutor had also linked these cyber-attacks to Russia’s strategy of sowing disorder in the West and causing economic damage. The interests of criminal hackers and state actors overlap in this regard. Moscow tolerates, or even encourages, such activities, he argued. But there is no evidence to suggest that the defendant himself had any direct links with the Russian secret services.

The defence lawyer called for his client’s full acquittal and compensation for wrongful detention. In his view, all the seized data storage media should be declared inadmissible, as the defendant had not been sufficiently informed, during the searches, of his right to have the data sealed.

The judgement is not final and may be subject to an appeal.

Join the debate:

+ How we produce news in English

Translated from French, reviewed by an English Department journalist.