Zurich court sentences ransomware developer to 12 years

A Zurich district court has sentenced a 52-year-old Ukrainian hacker to 12 years and nine months in prison and ordered his expulsion from Switzerland for 10 years, SRF reported. The court found that he helped carry out ransomware attacks on companies worldwide.

The man, who lives in the canton of Basel-Landschaft, encrypted company data to extort ransom payments. Victims included Swiss companies such as train manufacturer Stadler Rail, building technology firm Meier Tobler and financial software provider Crealogix.

The court found that he developed the malware and passed it to unidentified accomplices. They selected companies in Switzerland and abroad and coordinated the extortion attempts.

He had argued that he was merely an IT consultant and had not known his software would be used for criminal purposes. The court rejected that claim, noting that ransom letters had also been found among his data.

The sentence was nine months longer than the prosecution had requested. The man, who was arrested in October 2021, will remain in pre-trial detention for now. The verdict is not yet final and can be appealed to the Zurich High Court and the Federal Supreme Court.

The hacker developed key components of the Lockergoga, Megacortex and Nefilim malware families. During the attack on Stadler Rail, he stole about 500 gigabytes of confidential data and threatened to publish it online. The company refused to pay the ransom, while other businesses complied. The total damage is estimated at 100 million Swiss francs.

Alleged links to Russian intelligence

The trial, held in August, also drew attention because an alleged mastermind of the hacking group was said to have links to the Kremlin. According to the indictment, the man, who was also Ukrainian, had a cover identity from Russia’s FSB intelligence service. The United States offered a one million dollar reward for information leading to his capture.

He allegedly fell from a window in Moscow in November 2022 under mysterious circumstances. In his closing argument, the prosecutor said attacks on Western companies formed part of a Russian strategy to create unrest and economic damage in the West. He said the interests of criminal hackers and state actors overlapped, meaning the Russian state tolerated or even supported such activities.

However, there was no evidence that the 52-year-old man from Basel-Landschaft himself had links to Russian intelligence. His lawyer had sought a full acquittal and compensation for time in detention. The lawyer also argued that all seized storage devices should be ruled inadmissible because the defendant had not been sufficiently informed of his right to request the sealing of the data during the searches. The court rejected the argument.