Swiss District Court Sentences LockerGoga Developer to 12 Years and 9 Months

The Zurich District Court in Switzerland has sentenced a 52-year-old Ukrainian national to 12 years and 9 months in prison. It relates to involvement in the development of LockerGoga, MegaCortex, and Nefilim. According to reporting by Connor Jones of The Register, the man was found not to be the mastermind of the operations. The verdict was published on September 15, 2026.

In addition to the prison term, a 10-year ban from Switzerland was also ordered. The verdict is not yet final and can be appealed. The man had been in pretrial detention since October 2021. It is a heavy sentence handed down after prolonged detention.

Details of the Ruling by the Zurich District Court

The Zurich District Court found that the man was involved in developing three types of ransomware. They were LockerGoga, MegaCortex, and Nefilim. He was judged not to be the mastermind of the overall operations. Criminal liability was recognized for his role as a developer.

The sentence is 12 years and 9 months in prison. It was accompanied by a 10-year ban from Switzerland. Pretrial detention had continued since October 2021. The ruling comes after a detention period of nearly five years.

The verdict is not final. The defense is in a position to appeal. The focus will now be on proceedings in a higher court. The findings of fact and the appropriateness of the sentence will be reviewed again.

Finding of Involvement in Development and the

Defendant’s Denial

The defendant had consistently denied any knowledge of criminal use. He claimed that the source code found at his home was the product of contracted work. He explained that the client was a specific information security customer. He argued it was work for a client whose identity was unknown.

The court rejected this explanation. The reason was that ransom notes were also found in the defendant’s data. It judged that this corroborated the link between the development work and extortion. Swiss public broadcaster SWI reported this point.

The court found that the man played a significant role in the attacks. It judged that he was not merely a provider of tools. His involvement in the execution process of the attacks was recognized. The boundary between development and operation appears to have been at issue.

Ransomware attacks combine encryption and extortion. Files are encrypted and money is demanded in exchange for recovery. Many schemes also steal data and threaten to publish it. Developers are central to this mechanism.

Major Victims Including Stadler and Scale

of Damage

One of the main victims is rolling stock manufacturer Stadler Rail. A breach occurred in May 2020. At the time, the company did not use the word ransomware. It described it as a breach by malicious software.

The company said a data leak was highly likely. The perpetrators reportedly demanded a large sum of money. They threatened to publish the information if payment was not made. The company refused to pay.

The amount demanded in 2020 was reportedly $6 million. This attack was found to have been carried out with Nefilim. It is a separate case from the recent claim of responsibility by Everest. The company also refused to pay in this year’s case.

Damage also extended to other companies. They include air-conditioning equipment maker Meier Tobler. Software company Crealogix was also victimized. The court recognized significant involvement in these cases.

A September 2022 announcement by prosecutors indicated the scale of the damage. The damage affected more than 1,800 individuals and organizations in 71 countries. Losses were said to amount to several hundred million Swiss francs. The scope goes beyond a case involving a single developer.

History of the International Investigation

and U.S. Prosecution

The man was arrested in the Basel region in October 2021. The charges were money laundering and data damage. The Zurich prosecution announced the arrest in September 2022. The outline of the case became clear about a year later.

Other individuals involved were also identified in 2021 law enforcement operations. They are said to be persons involved in operating the three variants. Their names have not been made public. The investigation appears to have proceeded through international cooperation.

Separate prosecution is underway in the United States. Volodymyr Tymoshchuk was formally indicted last year. U.S. prosecutors have identified him as the mastermind of the three groups. This reflects a structure of pursuing developers and masterminds separately.

The three ransomware strains are said to have been operated separately. They are characterized by sharing a common development base. Arresting the developer deals a blow to the source of supply. Identification and prosecution of operators are also proceeding in parallel.

Measures and Challenges Required for

Corporate Defense

This case shows the impact on manufacturing and infrastructure. Rolling stock manufacturing, air conditioning, and software were targeted. There is a risk of simultaneous business disruption and data leakage. Both recovery planning and leak countermeasures are required.

On the defense front, understanding endpoint protection is important. As Microsoft Defender Privilege Escalation Vulnerability “RoguePlanet” Disclosed shows, managing privilege escalation paths is a challenge. Designs that curb lateral movement after intrusion are needed. Privilege management and log preservation are fundamental.

Attacks mainly target business computers and servers. It is a different domain from consumer video equipment such as LG OLED evo, Creator Original Picture Mode with Prime Video. It is also not directly related to augmented reality platforms such as Snapdragon Reality Elite, New Chip for AR/MR. Nevertheless, overall management including suppliers and connected devices is important.

Refusing to pay requires advance preparation. Recovery procedures to alternative systems are essential. Procedures for handling stolen data must also be established. Preserving negotiation records also helps cooperation with investigations.

Editorial Opinion

In the short term, the heavy sentence for the developer is likely to be shared as a deterrent example. Companies may review breach-assumption-based measures. Insurance and negotiation response procedures are also likely to be re-examined. Information sharing in manufacturing and software industries is also expected to advance.

In the long term, understanding of the division of labor between development and operation is likely to deepen. Cross-border cooperation in prosecution is expected to strengthen. Defenders are likely to emphasize resilience and evidence preservation. Developing systems to support decisions to refuse payment will be a challenge.

The remaining question is how the line between development acts and conspiracy was established. Was the basis for rejecting the defense’s claim of contracted development sufficient? Verification of the facts will be tested in the process leading to a final judgment. How to address division-of-labor-type crime is at issue.

References

• “Swiss court sentences 52-year-old Ukrainian ransomware dev to nearly 13 years in the cooler”, by Connor Jones — The Register, 2026-09-15T13:32:00.000Z (ARR)
• Source URL: https://www.theregister.com/security/2026/09/15/swiss-court-sentences-52-year-old-ukrainian-ransomware-dev-to-nearly-13-years-in-the-cooler/5296482