Skip to content
Ukrainian Hacker Sentenced for Ransomware Attacks on Swiss Companies

Ukrainian Hacker Sentenced for Ransomware Attacks on Swiss Companies

First seen 11 Sep 2026, 19:43 UTC

Article Content

Browse articles
ThreatCluster AI
ThreatCluster September 11, 2026 at 22:47 UTC
  • The hacker was sentenced to nearly 13 years for developing ransomware malware.
  • Stadler Rail and other companies suffered losses estimated at CHF 100 million.
  • The court found the defendant guilty despite his claims of ignorance regarding the malware's use.

A 52-year-old Ukrainian hacker was sentenced to 12 years and 9 months in prison by the Zurich District Court for his role in ransomware attacks targeting multiple firms, including Stadler Rail. The hacker developed malware used in extortion schemes, causing estimated damages of around 100 million Swiss francs ($123 million). He was found guilty of stealing approximately 500 gigabytes of confidential data from Stadler Rail and threatening to publish it online. Despite his claims of being an IT consultant unaware of the criminal use of his software, the court ruled against him, citing evidence of extortion messages found in his possession. The hacker is also banned from Switzerland for ten years and remains in pretrial detention, with the option to appeal the verdict. The case has drawn attention due to alleged ties between the hacker's associates and Russian intelligence. Other companies affected included Meier Tobler and Crealogix, with some paying the ransom while Stadler Rail refused.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2021-10
Hacker arrested
The 52-year-old Ukrainian hacker was arrested in October 2021 in Switzerland.
Bluewin.Ch
2026-09-08
Court sentencing
The Zurich District Court sentenced the hacker to 12 years and 9 months in prison.
Swissinfo.Ch
2026-09-11
Article publication
Both articles were published detailing the sentencing and the hacker's methods.
Bluewin.Ch and Swissinfo.Ch

More articles in this cluster (2)

Following this threat?

Track Nefilim, LockerGoga and Crealogix in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed