Ukrainian National Pleads Guilty to Conspiracy to Use Nefilim Ransomware to Attack Companies in the United States and Other Countries

According to U.S. Department of Justice, a Ukrainian national, Artem Aleksandrovych Stryzhak, 35, of Barcelona, Spain, pleaded guilty to one count of conspiracy to commit computer fraud for his role in a series of international ransomware attacks using Nefilim against organisations in the United States and other countries. The court documents say Stryzhak conspired with others to deploy the Nefilim ransomware by generating a unique executable file, a decryption key, and a customised ransom note for each victim.

In June 2021, Nefilim administrators gave him access to the ransomware code in exchange for 20 percent of his ransom proceeds, and he operated the ransomware through an online panel, later considering a different username to avoid federal detection. Nefilim administrators targeted companies in the United States, Canada, or Australia with annual revenues exceeding $100 million, and, in July 2021, encouraged focusing on those with more than $200 million in annual revenue.

Stryzhak was arrested in Spain in June 2024 and extradited to the United States on 30 April; he faces sentencing on 6 May 2026 with a maximum penalty of 10 years’ imprisonment. The case is being prosecuted by Trial Attorney Brian Z. Mund and Assistant U.S. Attorneys Alexander F. Mindlin and Ellen H. Sise, with cooperation from various agencies, and the U.S. Department of State’s TOC Rewards Programme has offered up to $11 million for information about a charged co-conspirator, Volodymyr Tymoshchuk.