Ukrainian ransomware affiliate sentenced to 70 months in prison

Artem Stryzhak, a 36-year-old Ukrainian national, was sentenced to 70 months in prison by a U.S. court for conspiracy to commit computer fraud in connection with ransomware campaigns that targeted hospitals, government entities, law firms and other businesses globally. The Department of Justice statements describe Stryzhak as a prolific ransomware affiliate who worked with multiple groups, including Nefilim and Hive, and who helped facilitate attacks over the course of 2021 and beyond.

Court documents state that Stryzhak joined Nefilim in June 2021, gaining access to the Nefilim ransomware and sharing 20% of extorted proceeds with Nefilim admins such as Volodymyr Tymoshchuk. The Nefilim attacks included a June 2021 data theft from an oil-and-gas transport firm, followed by the creation of ransom-notice email addresses.

Separately, Stryzhak was an early Hive affiliate and, from June 2021 to January 2023, Hive targeted about 1,500 victims worldwide, including government entities and healthcare providers, disrupting operations during the COVID-19 era. In one Hive case, a hospital could not accept new patients after the attack. The FBI allegedly provided a decryption key to a victim during a nationwide disruption campaign, allowing data to be recovered without paying a ransom.

Stryzhak was arrested in Spain in June 2024, extradited to the United States in April 2025, and pled guilty in December 2025 to two counts of conspiracy to commit fraud, extortion and related computer crimes. The State Department’s TOC Rewards programme offers up to $11 million for information about a charged co-conspirator, Volodymyr Tymoshchuk.