UKRAINIAN NATIONAL SENTENCED TO 70 MONTHS FOR ROLE IN RANSOMWARE ATTACKS TARGETING HOSPITALS, BUSINESSES AND GOVERNMENTS

BROOKLYN, NEW YORK — Artem Stryzhak, 36, a Ukrainian national formerly residing in Barcelona, Spain, was sentenced October 27, 2026, to 70 months in federal prison for his role in ransomware conspiracies that targeted hospitals, government entities, law firms, healthcare providers, and other businesses in the United States and abroad.

Stryzhak previously pleaded guilty in December 2025 to two counts of conspiracy to commit fraud, extortion, and related activity in connection with computers.

Federal prosecutors said Stryzhak participated in ransomware operations connected to both the Nefilim and Hive ransomware groups, which collectively caused extensive disruption and more than $100 million in losses.

Beginning around June 2021, Stryzhak joined the Nefilim operation as a ransomware affiliate. Under the arrangement, he received access to Nefilim ransomware and agreed to provide administrators, including alleged co-conspirator Volodymyr Viktorovych Tymoshchuk, with 20% of ransom proceeds obtained from victims.

The federal indictment describes Nefilim as ransomware used against computer networks in multiple countries, including the United States, Norway, France, Switzerland, Germany, and the Netherlands. Investigators alleged that affiliates obtained unauthorized access to victim networks, stole sensitive information, deployed ransomware to encrypt files, and demanded payment in exchange for decryption.

One attack attributed to Stryzhak involved a company in the oil and gas transportation industry in June 2021. Prosecutors said data was stolen from the company before ransom communications were prepared and sent to the victim. Stryzhak remained involved with the Nefilim conspiracy through at least October 2021.

Stryzhak also became one of the earliest affiliates of the Hive ransomware group. From June 2021 through January 2023, Hive actors attacked approximately 1,500 victims worldwide, including hospitals, government organizations, businesses, law firms, and other entities.

A joint federal cybersecurity advisory issued by the FBI, CISA, and Department of Health and Human Services documented that Hive operated under a ransomware-as-a-service model and heavily targeted critical infrastructure, including the Healthcare and Public Health sector. As of November 2022, federal authorities had identified more than 1,300 victim organizations and approximately $100 million in ransom payments associated with Hive.

As a Hive affiliate, Stryzhak and his co-conspirators deployed ransomware against seven victims, including law firms, a dental office, and a healthcare provider during the COVID-19 pandemic. Victims lost access to encrypted data, and the broader Hive campaign disrupted healthcare operations in some cases.

In one documented hospital attack involving the Hive group, medical personnel were forced to operate without normal digital systems, and the facility was temporarily unable to accept new patients.

Federal investigators ultimately disrupted Hive’s infrastructure and obtained decryption capabilities that allowed victims to recover encrypted systems without paying ransom demands. In Stryzhak’s case, the FBI provided a decryption key to one of his victims, allowing the organization to restore its data without paying the attackers.

Federal cybersecurity guidance issued during the Hive campaign documented tactics that included compromised remote-access credentials, phishing, exploitation of vulnerable internet-facing systems, disabling security tools, deleting Windows event logs, removing shadow copies, exfiltrating data, and encrypting victim systems.

Stryzhak was arrested in Spain in June 2024 and extradited to the United States in April 2025.

The Nefilim investigation was conducted by the FBI Springfield Field Office, while the Hive investigation was handled by the FBI Tampa Field Office. The FBI New York Field Office, the Justice Department’s Office of International Affairs, and Spanish authorities assisted in locating, arresting, and extraditing Stryzhak.

Federal authorities continue to seek Volodymyr Tymoshchuk, who is charged as Stryzhak’s co-conspirator and is accused of involvement in ransomware operations. The U.S. Department of State’s Transnational Organized Crime Rewards Program has offered a reward of up to $11 million for information leading to Tymoshchuk’s arrest, conviction, or location.

The Nefilim case was prosecuted by Acting Assistant Deputy Chief James S. Yoon and former Senior Trial Attorney Brian Z. Mund of the Justice Department’s Computer Crime and Intellectual Property Section, along with Assistant U.S. Attorneys Alexander F. Mindlin and Ellen H. Sise of the Eastern District of New York’s National Security and Cybercrime Section. The Hive case was prosecuted by CCIPS Trial Attorneys Alison M. Zitron and Christen M. Gallagher, along with Assistant U.S. Attorney Hannah Watson for the Middle District of Florida.

U.S. District Court for the Eastern District of New York, Superseding Indictment — United States v. Artem Aleksandrovych Stryzhak, filed May 7, 2024 (Free Download)

Federal Bureau of Investigation, Cybersecurity and Infrastructure Security Agency, and U.S. Department of Health and Human Services, #StopRansomware: Hive Ransomware, Joint Cybersecurity Advisory AA22-321A, November 17, 2022. (Free Download)

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

Sponsored • TRJ Ads
Inquiries: contact@therealistjuggernaut.com

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE