Zurich Court Hands Ukrainian Developer 13-Year Term for Lockergoga, MegaCortex, Nefilim Code

Court records identify the defendant as the primary coder rather than operational mastermind, supplying custom builds and updates to extortion crews between 2018 and 2021. Prosecutors documented deployment against at least eight victims; forensic artifacts linked the binaries directly to the accused’s development environment. The verdict is under appeal.

Mandiant’s 2026 report shows attackers have shifted from chatbot queries to autonomous agents that manage full intrusion chains, including a worm spread across 100 repositories via a compromised coding assistant. The same pattern appears in the Swiss case where the developer supplied modular ransomware that operators could tune without further contact.

NIST and CISA’s token-theft guidance underscores that credential and session-token protections remain the missing layer in many ransomware campaigns; the sentenced developer’s tooling relied on stolen domain credentials for lateral movement. No independent technical attribution beyond court-accepted binary hashes has been published.

Next steps include monitoring whether the Swiss precedent prompts additional European arrests of ransomware coders and whether the $123 million figure triggers larger civil claims from insurers and victims.