16th September 2025 Cyber Update: US Targets Ransomware Administrator with Global Charges and $10M Reward

The Update: Unsealed on 9 September 2025, the indictment details how Tymoshchuk oversaw ransomware campaigns between December 2018 and October 2021. The operations caused widespread disruption, extorting businesses through ransom demands and leaving many organisations with costly recovery bills.

“Volodymyr Tymoshchuk is charged for his role in ransomware schemes that extorted more than 250 companies across the United States and hundreds more around the world,” said Acting Assistant Attorney General Matthew R. Galeotti. “In some instances, these attacks resulted in the complete disruption of business operations until encrypted data could be recovered or restored. This prosecution and today’s rewards announcement reflects our determination to protect businesses from digital sabotage and extortion and to relentlessly pursue the criminals responsible, no matter where they are located.”

FBI assistant director Christopher Raia added: “Tymoshchuk repeatedly used ransomware attacks to target hundreds of companies in the United States and around the globe in attempts to extort victims. Today’s announcement should serve as a warning, cyber criminals may believe they act with impunity while conducting harmful cyber intrusions, but law enforcement is onto you and will hold you accountable. The FBI along with our law enforcement partners will continue to scour the globe to bring to justice any individual attempting to use the anonymity of the internet to commit crime.”

International cooperation previously led to the extradition of a co-conspirator from Spain in 2024, with European authorities playing a key role in related actions. Decryption keys for LockerGoga and MegaCortex were released in September 2022, helping victims recover data. Tymoshchuk remains a fugitive and faces charges including conspiracy to commit computer fraud, conspiracy to damage protected computers and transmitting ransom demands. The State Department is offering up to $10 million for information leading to his arrest, with an additional $1 million reward for tips on other group leaders.

Why it Matters: This case highlights the persistent threat of organised ransomware syndicates and the global collaboration needed to disrupt them. By targeting an administrator rather than just affiliates, U.S. authorities are striking at the leadership structures that sustain these operations. The inclusion of Nefilim in the indictment confirms links between major ransomware variants.

The State Department’s $10 million reward underscores the case’s seriousness, though extradition from Ukraine remains uncertain amid the country’s ongoing conflict. For businesses, the case is a reminder that ransomware can cause crippling operational disruption and financial loss, and that prevention and resilience remain essential despite law enforcement wins.