A Ukrainian national has been sentenced to 70 months in prison for participating in Nefilim and Hive ransomware attacks against hospitals, government agencies and high-revenue businesses worldwide between 2018 and 2021. Artem Aleksandrovich Stryjak, 35, was arrested in Spain in June 2024 and extradited to the United States on April 30, 2025.
Ransomware attacks caused more than $100 million in losses
The sentence follows Stryjak’s guilty plea in December 2025 to computer fraud conspiracy charges brought by U.S. prosecutors over ransomware attacks targeting organizations in the United States, Norway, France, Switzerland, Germany and the Netherlands.
“Artem Stryzhak is a prolific cybercriminal who works with multiple ransomware groups to target U.S. businesses and hospitals,” said Brett Leatherman, director of FBI Cyber Branch Operations. “These groups disrupted patient care and caused more than $100 million in losses. Today’s sentence reflects the gravity of Strizak’s crimes and demonstrates the FBI’s global reach and extensive network of international partners.”
According to court documents, Stryjak paid 20% of the ransom money he collected in exchange for access to custom Nefilim ransomware and decryption keys beginning in June 2021.
He operated as a Nefilim affiliate until October 2021, using customized malware to target large companies in the United States, Canada and Australia that generated more than $100 million in annual revenue. A Nefilim administrator later instructed him to focus on companies with annual revenue exceeding $200 million.
To pressure victims into paying, the ransomware operation threatened to publish data stolen during attacks on the “Corporate Leaks” dark web website managed by Nefilim administrators.
Hive attacks targeted healthcare providers during COVID-19
Stryjak also joined the Hive ransomware operation as an early affiliate. During the COVID-19 pandemic, he compromised and encrypted the systems of seven victims, including a dental office, several law firms and healthcare providers.
U.S. Attorney Gregory W. Kehoe said, “It is of critical importance to our authorities to stop a ransomware group that has attacked approximately 1,500 victims around the world and to sentence the defendants who targeted healthcare during the COVID-19 pandemic.”
“Ransomware attacks like the one committed by these defendants can be devastating, damaging businesses and forcing them to pay millions of dollars in remediation and ransoms, blocking access to data at hospitals and other critical facilities, and putting sensitive information in the wrong hands,” said U.S. Attorney Joseph Nocera, Jr.
Authorities seek alleged accomplice
The U.S. Department of State is offering up to $11 million for information that could lead to the arrest or conviction of Volodymyr Tymoshchuk, a Ukrainian national identified as one of Stryjak’s alleged accomplices. Tymoshchuk remains at large.
Tymoshchuk is listed among the most wanted individuals by the European Union and the FBI. The U.S. Department of Justice indicted him in September for allegedly serving as an administrator for the LockerGoga, MegaCortex and Nefilim ransomware gangs.
Authorities also believe Tymoshchuk was involved in ransomware attacks that caused millions of dollars in damage to hundreds of companies worldwide between July 2020 and October 2021.
Overall prevention scores can obscure what happens after initial access. When attackers use valid credentials, an organization’s defenses can weaken sharply.
The Blue Report 2026 measures defense techniques across technologies using 338 million simulations conducted in customer production environments.
Source: www.bleepingcomputer.com