The person at the center of this case
Volodymyr Viktorovych Tymoshchuk (fugitive)
Justice for Volodymyr Viktorovych Tymoshchuk (fugitive) — the trail went cold in 2024, but the truth hasn't.
Start here
What is Tymoshchuk's current location given his known ties to Poland, Romania, Moldova, Türkiye, Russia, and Belarus?
How were the three ransomware variants (LockerGoga, MegaCortex, Nefilim) technically connected and what infrastructure linked them?
Who were the co-conspirators working with Tymoshchuk in the ransomware operation and have they been identified or apprehended?
Volodymyr Viktorovych Tymoshchuk is an alleged ransomware administrator who, from December 2018 through October 2021, deployed LockerGoga, MegaCortex, and Nefilim ransomware variants to compromise computer networks of hundreds of companies worldwide, including over 250 U.S. firms, to extort ransom payments. A federal arrest warrant was issued on May 7, 2024, in the Eastern District of New York for multiple counts including conspiracy to commit fraud, intentional damage to protected computers, unauthorized access, and transmitting threats to disclose confidential information. Tymoshchuk remains at large with suspected ties to Poland, Romania, Moldova, Türkiye, Russia, and Belarus, and a reward of up to $10,000,000 is offered for information leading to his capture.
Try asking
A one-time $10 claim transfers this imported case workspace to your account. You get 10 uploads for this case, 25 daily AI questions for this case, and public tips with files route to you.
This does not start a subscription. When the included limits are reached, the Personal plan unlocks more workspace capacity.
Beyond the top three above — each detail below could be the thread that pulls this case open.
What methods can the public use to report credible sightings or information about Tymoshchuk's whereabouts?
Even the smallest detail could be the key to solving this case.
Official wording
Conspiracy to Commit Fraud and Related Activity in Connection with Computers; Intentional Damage to a Protected Computer; Unauthorized Access to a Protected Computer; Transmitting a Threat to Disclose Confidential Information Caution: Volodymyr Viktorovych Tymoshchuk is an alleged ransomware administrator of at least three different ransomware variants. From December of 2018, through October of 2021, Tymoshchuk and his co-conspirators allegedly deployed LockerGoga, MegaCortex, and Nefilim ransomware, which compromised the computer networks of hundreds of companies around the world, including more than 250 companies in the United States, in order to extort ransom payments from the victim companies.
On May 7, 2024, a federal arrest warrant was issued for Tymoshchuk in the United States District Court, Eastern District of New York, Brooklyn, New York, after he was charged with two counts of Conspiracy to Commit Fraud and Related Activity in Connection with Computers; multiple counts of Intentional Damage to a Protected Computer; Unauthorized Access to a Protected Computer; and Transmitting a Threat to Disclose Confidential Information. Remarks: Tymoshchuk has ties to Poland, Romania, Moldova, Türkiye, Russia, and Belarus.
Tymoshchuk and co-conspirators begin deploying LockerGoga ransomware against victim companies
Final known deployment of Nefilim ransomware; campaign spans approximately three years targeting hundreds of companies
Warrant issued in United States District Court, Eastern District of New York, Brooklyn, New York for conspiracy to commit fraud and related computer crimes
For information leading to the resolution of this case
For information leading to the resolution of this case