A Ukrainian national, Artem Aleksandrovych Stryzhak, has been sentenced to 70 months in prison in the United States for his involvement in the Nefilim and Hive ransomware operations. Stryzhak, 36, was arrested in Spain in June 2024 and extradited to the U.S. in April 2025, where he pleaded guilty in December 2025. His actions are linked to significant cyberattacks that targeted various organizations, including healthcare providers and law firms.
According to court documents, Stryzhak became an affiliate of the Nefilim ransomware group in June 2021, agreeing to pay 20% of the ransom proceeds to the group’s administrators. His criminal activities reportedly spanned several months, during which he targeted an unnamed company in the oil and gas transportation sector. Additionally, Stryzhak was an early affiliate of the Hive ransomware group, which has been implicated in attacks against over 1,500 victims globally from June 2021 to January 2023.
During his tenure with Hive, Stryzhak utilized the ransomware against seven organizations, including a dental office and a healthcare provider. Some victims reportedly paid ransoms, receiving decryption keys in return to recover their encrypted files. The FBI has stated that Stryzhak’s actions contributed to over $100 million in losses, significantly disrupting patient care and operations within targeted organizations.
FBI operations director Brett Leatherman characterized Stryzhak as a “prolific cybercriminal” whose activities have had far-reaching consequences. The U.S. State Department is currently offering rewards of up to $10 million for information leading to the arrest or conviction of Volodymyr Tymoshchuk, the alleged administrator of Nefilim, who remains at large, as well as up to $1 million for information on other leaders of the ransomware groups he managed.
This case underscores the ongoing challenges posed by ransomware operations and the international efforts to combat cybercrime. As law enforcement agencies continue to pursue those involved in such activities, the ramifications of these cyberattacks highlight the critical need for robust cybersecurity measures across all sectors.
For further details, see the report by SecurityWeek.
