A Ukrainian national has been sentenced to 70 months in prison for his involvement in Nefilim and Hive ransomware attacks that targeted hospitals, government entities, and large corporations worldwide between 2018 and 2021, the US Justice Department announced.
Artem Aleksandrovych Stryzhak, 35, was extradited to the United States on April 30, 2025 after his arrest in Spain in June 2024. He pleaded guilty in December 2025 to computer fraud conspiracy charges brought by US prosecutors in connection with ransomware attacks on businesses in the United States, Norway, France, Switzerland, Germany, and the Netherlands.
"Artem Stryzhak is a prolific cybercriminal who worked with multiple ransomware groups to target U.S. businesses and hospitals," said Brett Leatherman, the FBI's Cyber Branch Operations Director. "These groups disrupted patient care and caused more than $100 million in losses. Today's sentence reflects the seriousness of Stryzhak's crimes and demonstrates the FBI's global reach and extensive network of international partners."
According to court documents, Stryzhak paid for 20% of all ransom payments collected for access to custom Nefilim ransomware and decryption keys from June 2021. He operated as a Nefilim affiliate until October 2021, targeting large corporations in the United States, Canada, and Australia with revenues exceeding $100 million annually. A Nefilim administrator later encouraged him to focus on companies generating more than $200 million per year.
The ransomware operation threatened to leak stolen data on dark web "Corporate Leaks" websites unless victims paid. Stryzhak also joined Hive ransomware as an early affiliate, breaching and encrypting systems of seven victims, including a dentist's office, law firms, and a healthcare provider during the COVID-19 pandemic.
"Disrupting a ransomware group that attacked approximately 1,500 victims worldwide and sentencing a defendant who had targeted healthcare during the COVID-19 pandemic is of significant importance to this office," added US Attorney Gregory W. Kehoe.
US Attorney Joseph Nocella Jr. noted that ransomware attacks cause enormous harm by costing millions in remediation and ransoms, preventing hospitals from accessing data, and exposing sensitive information.
The US State Department is offering up to $11 million for information leading to the arrest of Ukrainian national Volodymyr Tymoshchuk, an alleged accomplice who remains at large. Tymoshchuk is on the most-wanted lists of the European Union and the FBI, and was charged in September for his roles as an administrator for the LockerGoga, MegaCortex, and Nefilim ransomware gangs.
Analysis
Why This Matters
- The sentence highlights international cooperation in pursuing cybercriminals who disrupt critical infrastructure like hospitals.
- Ransomware attacks continue to pose a significant threat to businesses and healthcare providers, with potential for patient care disruption and data exposure.
- The case demonstrates law enforcement's ability to track and prosecute affiliates of major ransomware operations even years after the attacks.
Background
Stryzhak was an affiliate of the Nefilim and Hive ransomware groups, which are known for targeting large organizations for financial gain. Nefilim operated between 2020 and 2021, using custom malware and data leak threats. Hive ransomware was active from 2021 until its disruption by international law enforcement in early 2023. Both groups caused millions in damages globally. Stryzhak's extradition from Spain and guilty plea were key steps in the US Justice Department's ongoing efforts against ransomware.
What to Watch
- Whether authorities arrest alleged accomplice Volodymyr Tymoshchuk, who remains at large and faces charges related to multiple ransomware operations.
- Future developments in the broader crackdown on Nefilim and Hive affiliates, as investigations into the networks continue.
Checked
12 claims in this story checked against 1 source: 11 supported.
Show each claim
- SupportedA Ukrainian ransomware affiliate was sentenced to 70 months for involvement in attacks on hospitals and businesses.BleepingComputer: “A Ukrainian national was sentenced to 70 months in prison for his role in Nefilim and Hive ransomware attacks targeting hospitals, government entities, and high-revenue businesses worldwide between 2018 and 2021.”
- SupportedStryzhak pleaded guilty to computer fraud conspiracy for roles in Nefilim and Hive ransomware operations.BleepingComputer: “Stryzhak also joined Hive ransomware as an early affiliate, breaching and encrypting the systems of seven victims, including a dentist's office, multiple law firms, and a healthcare provider during the COVID-19 pandemic. In December 2025, Stryzhak pleaded guilty and admitted to computer fraud conspiracy charges”
- Not in the sourcesThe US Justice Department announced Stryzhak's sentence.BleepingComputer: “A Ukrainian national was sentenced to 70 months in prison for his role in Nefilim and Hive ransomware attacks”
- SupportedThe attacks targeted hospitals, government entities and large corporations worldwide between 2018 and 2021.BleepingComputer: “A Ukrainian national was sentenced to 70 months in prison for his role in Nefilim and Hive ransomware attacks targeting hospitals, government entities, and high-revenue businesses worldwide between 2018 and 2021.”
- SupportedLeatherman called Stryzhak “a prolific cybercriminal who worked with multiple ransomware groups to target U.S. businesses and hospitals.”BleepingComputer: “"Artem Stryzhak is a prolific cybercriminal who worked with multiple ransomware groups to target U.S. businesses and hospitals," said Brett Leatherman, the FBI's Cyber Branch Operations Director.”
- SupportedLeatherman said the groups disrupted patient care and caused more than $100 million in losses.BleepingComputer: “"These groups disrupted patient care and caused more than $100 million in losses. Today's sentence reflects the seriousness of Stryzhak's crimes and demonstrates the FBI's global reach and extensive network of international partners."”
- SupportedStryzhak was arrested in Spain in June 2024 and extradited to the United States on April 30, 2025.BleepingComputer: “The sentence follows the extradition of 35-year-old Artem Aleksandrovych Stryzhak to the United States on April 30, 2025, after authorities arrested him in Spain in June 2024.”
- SupportedStryzhak pleaded guilty in December 2025 to computer fraud conspiracy charges.BleepingComputer: “In December 2025, Stryzhak pleaded guilty and admitted to computer fraud conspiracy charges brought by US prosecutors”
- SupportedThe attacks connected to the charges targeted businesses in the United States, Norway, France, Switzerland, Germany and the Netherlands.BleepingComputer: “in connection with ransomware attacks targeting businesses in the United States, Norway, France, Switzerland, Germany, and the Netherlands.”
- SupportedFrom June 2021, Stryzhak paid for 20% of all ransom payments collected in exchange for access to custom Nefilim ransomware and decryption keys.BleepingComputer: “According to court documents, he paid for 20% of all ransom payments collected for access to custom Nefilim ransomware and decryption keys starting in June 2021.”
- SupportedStryzhak joined Hive as an early affiliate and breached and encrypted seven victims' systems.BleepingComputer: “Stryzhak also joined Hive ransomware as an early affiliate, breaching and encrypting the systems of seven victims, including a dentist's office, multiple law firms, and a healthcare provider during the COVID-19 pandemic.”
- SupportedThe State Department is offering up to $11 million for information leading to the arrest of alleged accomplice Volodymyr Tymoshchuk.BleepingComputer: “The US State Department also offers up to $11 million for any details that could lead to the arrest of Ukrainian national Volodymyr Tymoshchuk, one of Stryzhak's alleged accomplices, who is still at large.”
