Ukrainian Hacker from Baselland Sentenced to 12 Years and 9 Months Imprisonment
The Zurich district court sentenced a 52-year-old Ukrainian to nearly 13 years imprisonment for ransomware extortion and child pornography.
Zurich District Court Convicts Ransomware Developer
The Zurich district court sentenced a 52-year-old Ukrainian software developer to an unconditional prison sentence of twelve years and nine months on 10 September. According to 20 Minuten, the man, who has lived with his family in the canton of Baselland since 2012, has been in pre-trial detention since October 2021. In addition to the prison sentence, he will be expelled from the country for ten years and must pay 300,000 francs to the state.
The court found him guilty of extortion, attempted extortion, aggravated data damage and pornography offences. "The accused's testimony was not convincing to the court," said the presiding judge. The defendant repeatedly invoked his right to remain silent, dodged questions or claimed he could not remember.
Three Years of Ransomware Development, Damage Exceeding 100 Million Francs
"A multitude of digital traces were found on his storage devices," the judge explained. The defendant had substantially contributed to the development of the ransomware used over a period of three years, without holding a leadership role within the group. "His approach was professional," the judge said.
The hacker group aimed to penetrate the IT networks of companies in Western Europe and North America, encrypt data including backup files, and then demand ransom in Bitcoin. In an extortion message, the perpetrators claimed the data was secured with military-grade algorithms — any attempt at recovery by third parties would lead to permanent destruction.
The indictment lists ten affected companies, including four Swiss firms: train manufacturer Stadler Rail, building services company Meier Tobler, IT company Crealogix and coating firm IHI Ionbond. Three companies — none of them Swiss — paid ransom totalling 4.5 million francs. The resulting total damage is estimated at over 100 million francs; affected companies suffered operational interruptions, delivery delays and work stoppages.
The defendant is said to have received approximately half a million francs in Bitcoin from ransom payments and ransomware development.
Connection to FSB-Linked Client in Moscow
According to the indictment, the convicted man joined forces in June 2018 with Oleksandr Ieremenko, a Ukrainian client operating in Moscow who acted under a cover identity of the Russian secret service FSB. The prosecutor pointed out that Ieremenko had good connections to the FSB and was sought by the US Secret Service in 2020, which had issued a reward of one million dollars.
Ieremenko is said to have died in a fall from a window in Moscow in February 2022. According to 20 Minuten, whether it was suicide, an accident or a killing remains unclear. The NZZ also considered the possibility that the death could have been staged to allow Ieremenko to go into hiding under a new identity.
Child Pornographic Content Seized on Computers
Regarding the charge of illegal child pornography, the judge stated: "The defendant actively searched for such images and collected them on his computers." A large quantity of child pornographic images and films were found on his computer and laptop, according to the court.
Prosecutor and Defence Hold Opposing Positions
The prosecutor had demanded an unconditional prison sentence of twelve years and expulsion from the country for the same period. "The defendant was not a peripheral figure," he said. The software developer had played a central role in the hacker group and had deliberately committed crimes for years.
His defence counsel — already the fourth in these proceedings — demanded a complete acquittal and compensation for nearly five years of detention. "The prosecutor has failed to prove which actions the defendant personally or as an accomplice committed," he argued. The defence also criticised procedural defects in the house search: the defendant had not been adequately informed of his right to seal the electronic data, which meant all computer evaluations were inadmissible.
During the hearing, the defendant denied any involvement: "I have never done anything like that." When the judge mentioned that the ransomware had been found on his devices during the house search, the defendant responded: "I worked for an unknown client, but never developed extortion software."
Source: 20 Minuten