Ukrainian Nefilim Ransomware Affiliate Pleads Guilty in US

On 22 December 2025, a 35-year-old Ukrainian national, Artem Aleksandrovych Stryzhak, pleaded guilty in a US court to conspiracy to commit fraud related to computers after being extradited to the United States in late April 2025. Court documents indicate he was a Nefilim ransomware affiliate, with administrators providing him malware and other resources in exchange for 20% of the money he received from victims.

Stryzhak became a Nefilim affiliate around June 2021, and prosecutors say he was involved in other criminal activities while targeting major companies worldwide. Authorities say the group encouraged attacks on companies in the United States, Canada and Australia, with annual revenue exceeding $200 million. The operation involved stealing data from victims’ systems, deploying file-encrypting malware, and demanding a ransom to decrypt the files and prevent data from being publicised. One of Stryzhak’s co-conspirators, Volodymyr Tymoshchuk, remains at large with an $11 million reward.