Ukrainian software developer faces 12 years in Swiss ransomware trial

Swiss prosecutors are seeking a 12-year prison sentence for a Ukrainian software developer linked to an international ransomware operation that caused hundreds of millions of dollars in damage to its victims.

The 52-year-old defendant went on trial at Zurich District Court on Monday over his alleged involvement in attacks using LockerGoga, MegaCortex and Nefilim ransomware. His alleged victims included Swiss train manufacturer Stadler Rail, banking software developer Crealogix and building technology company Meier Tobler.

The Ukrainian, whose name has not been publicly disclosed by Swiss authorities, denied developing malware or participating in ransomware attacks. Prosecutors are seeking to expel him from Switzerland for 12 years and recover 1.8 million Swiss francs ($2.2 million) in alleged criminal proceeds.

The defendant has been in custody since October 2021. A verdict is expected in September.

Prosecutors accuse the Ukrainian of being a key developer for an unnamed cybercriminal group that hacked corporate networks, stole data and encrypted systems to extort victims.

The defendant rejected prosecutors' account, telling the court that ransomware source code discovered on his devices came from a cybersecurity client for whom he had worked as a consultant. His defense also questioned the digital evidence, arguing that investigators had failed to maintain complete records of the data they seized.

The prosecution alleges that another Ukrainian hacker, Oleksandr Ieremenko, who operated from Moscow, directed attacks carried out by the defendant in Switzerland, according to Swiss journalists who attended Monday's hearing.

Swiss prosecutors cited testimony from a source in Ukraine alleging that Ieremenko enjoyed protection from Russia's Federal Security Service, or FSB. Ieremenko reportedly died after falling from a window in Moscow in 2022, though prosecutors said they could not establish whether his death was an accident, suicide or killing.

Prosecutors did not present evidence that the defendant himself had direct ties to Russian intelligence.

The case follows an investigation launched after ransomware attacks against companies in Zurich in 2019. It eventually expanded into an international operation involving authorities in Switzerland, France, the Netherlands, Norway, Ukraine and the United States.

Zurich prosecutors allege that the defendant directly participated in attacks against 10 companies in Switzerland and other countries between December 2018 and May 2020. Those incidents caused more than 130 million Swiss francs ($160 million) in estimated losses, including lost revenue and the cost of rebuilding affected computer systems.

The defendant also faces charges related to child sexual abuse material. Swiss media reported that investigators discovered nearly 7,000 images and more than 500 videos depicting sexual acts involving children in an encrypted file container during a search. Earlier Federal Supreme Court records confirm that pornography offenses are part of the criminal proceedings.