The $100M Stalker: Nefilim Ransomware Affiliate Pleads Guilty as DOJ Hunts Fugitive Leader

Artem Aleksandrovych Stryzhak, a Ukrainian national, pleaded guilty to conspiracy to commit computer fraud for his role in the Nefilim ransomware operation, according to the Department of Justice (DOJ).

He joined the scheme in June 2021, operating under a profit‑sharing model in which he kept 20 percent of the ransom proceeds and managed attacks via a platform nicknamed the “panel.” Prosecutors noted his concern about operational security, including a question about changing his username “in case the panel ‘gets hacked into by the feds.’” Stryzhak was arrested in Spain in June 2024 and extradited to the United States on 30 April 2024.

The DOJ described Nefilim as selectively targeting companies in the United States, Canada or Australia with revenues above $100 million, later raising the bar to organisations with annual revenues over $200 million. The group used a double extortion tactic, stole data and published it on Corporate Leaks websites if victims did not pay, with a customised decryption key provided to those who complied.

Stryzhak’s sentencing is scheduled for 6 May 2026, while a co-conspirator, Volodymyr Tymoshchuk, has a reward of up to $11 million offered for information leading to arrest, conviction or location.