In addition, INL is also announcing a separate reward offer of up to $1 million for information leading to the arrests and/or convictions of other key leaders (other than Tymoshchuk and a known co-conspirator) of the Nefilim, LockerGoga, and MegaCortex ransomware variants.
According to a criminal indictment filed in the Eastern District of New York (EDNY), from at least December 2018 to at least October 2021, Tymoshchuk and other co‑conspirators used the Nefilim, LockerGoga, and MegaCortex ransomware variants to encrypt computer networks and deploy ransomware schemes against hundreds of victim company network owners in the United States and other countries around the world.
The ransomware schemes were costly to U.S. victims, both in ransom payments and mitigation costs.
Today’s announcement was made in coordination with the Department of Justice, the FBI, and Europol, and our partners in Germany, France, and Norway. The Department of Justice announced the unsealing of the superseding indictment, charging Tymoshchuk with seven counts relating to his ransomware activity. Tymoshchuk remains a fugitive.
Today’s reward offers are authorised by the Secretary of State under the TOCRP, which supports law enforcement efforts to disrupt transnational crime, including ransomware, globally. If you have information, please contact the FBI at +1-917-242-1407 (WhatsApp/Signal) or by email at TymoTips@fbi.gov. If you are in the United States, you can also contact the local FBI field office. If you are outside the United States, you can visit the nearest U.S. embassy.
ALL IDENTITIES ARE KEPT STRICTLY CONFIDENTIAL. Government officials and employees are not eligible for rewards.
