A Ukrainian national was sentenced to 70 months in prison for his role in Nefilim and Hive ransomware attacks targeting hospitals, government entities, and high-revenue businesses worldwide between 2018 and 2021.
The sentence follows the extradition of 35-year-old Artem Aleksandrovych Stryzhak to the United States on April 30, 2025, after authorities arrested him in Spain in June 2024.
"Artem Stryzhak is a prolific cybercriminal who worked with multiple ransomware groups to target U.S. businesses and hospitals," said Brett Leatherman, the FBI's Cyber Branch Operations Director. "These groups disrupted patient care and caused more than $100 million in losses. Today's sentence reflects the seriousness of Stryzhak's crimes and demonstrates the FBI's global reach and extensive network of international partners."
According to court documents, he paid for 20% of all ransom payments collected for access to custom Nefilim ransomware and decryption keys starting in June 2021.
While active as a Nefilim affiliate until October 2021, Stryzhak used the custom-tailored malware to target large corporations in the United States, Canada, and Australia with revenues exceeding $100 million each year. However, one of the Nefilim administrators later encouraged him to focus on large companies that were generating more than $200 million annually.
To pressure victims into paying, the ransomware operation also threatened to leak data stolen during attacks on dark web "Corporate Leaks" websites managed by the Nefilim admins unless victims met the ransom demands.
Stryzhak also joined Hive ransomware as an early affiliate, breaching and encrypting the systems of seven victims, including a dentist's office, multiple law firms, and a healthcare provider during the COVID-19 pandemic.
In December 2025, Stryzhak pleaded guilty and admitted to computer fraud conspiracy charges brought by US prosecutors in connection with ransomware attacks targeting businesses in the United States, Norway, France, Switzerland, Germany, and the Netherlands.
"Disrupting a ransomware group that attacked approximately 1,500 victims worldwide and sentencing a defendant who had targeted healthcare during the COVID-19 pandemic is of significant importance to this office," added US Attorney Gregory W. Kehoe.
"Ransomware attacks like those committed by the defendant wreak enormous havoc — harming victim companies that pay millions in remediation and ransoms, preventing hospitals and other critical facilities from accessing data, and putting sensitive information in the hands of bad actors," US Attorney Joseph Nocella Jr. noted.
The US State Department also offers up to $11 million for any details that could lead to the arrest of Ukrainian national Volodymyr Tymoshchuk, one of Stryzhak's alleged accomplices, who is still at large.
Tymoshchuk is on the most-wanted lists of the European Union and the FBI, and the US Justice Department charged him in September for his roles as an administrator for the LockerGoga, MegaCortex, and Nefilim ransomware gangs. He was also allegedly involved in ransomware attacks that caused millions of dollars in damages to hundreds of companies around the world between July 2020 and October 2021.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Get the report