Artem Aleksandrovych Stryzhak, a Ukrainian national, has been sentenced to 70 months in prison following his extradition to the United States on April 30, 2025. Authorities had apprehended him in Spain in June 2024. His conviction stems from his involvement in ransomware campaigns orchestrated by Nefilim and Hive between 2018 and 2021, which struck hospitals, government agencies, and profitable enterprises across multiple continents.
According to court filings, Stryzhak collected a 20% share of all ransom payments received in exchange for access to a custom-built Nefilim ransomware variant and corresponding decryption tools beginning in June 2021. During his tenure as a Nefilim affiliate through October 2021, he deployed the tailored malware against major corporations in the United States, Canada, and Australia—organizations with annual revenues surpassing $100 million. Nefilim leadership subsequently urged him to concentrate efforts on even larger targets generating more than $200 million yearly.
The Nefilim operation leveraged a coercion tactic to compel payment: threatening to publish stolen data on dark web "Corporate Leaks" portals controlled by the group's administrators unless victims complied with ransom demands.
Beyond his Nefilim involvement, Stryzhak joined Hive ransomware as an early-stage affiliate, successfully compromising and encrypting systems belonging to seven targets. His victims included a dental practice, several legal firms, and a healthcare organization—attacks that occurred during the COVID-19 pandemic.
In December 2025, Stryzhak entered a guilty plea to computer fraud conspiracy charges filed by federal prosecutors. The charges encompassed ransomware operations targeting organizations across the United States, Norway, France, Switzerland, Germany, and the Netherlands.
Artem Stryzhak is a prolific cybercriminal who worked with multiple ransomware groups to target U.S. businesses and hospitals. These groups disrupted patient care and caused more than $100 million in losses. Today's sentence reflects the seriousness of Stryzhak's crimes and demonstrates the FBI's global reach and extensive network of international partners.
Brett Leatherman, FBI Cyber Branch Operations Director
Disrupting a ransomware group that attacked approximately 1,500 victims worldwide and sentencing a defendant who had targeted healthcare during the COVID-19 pandemic is of significant importance to this office.
US Attorney Gregory W. Kehoe
Ransomware attacks like those committed by the defendant wreak enormous havoc — harming victim companies that pay millions in remediation and ransoms, preventing hospitals and other critical facilities from accessing data, and putting sensitive information in the hands of bad actors.
US Attorney Joseph Nocella Jr.
Authorities continue searching for Volodymyr Tymoshchuk, identified as one of Stryzhak's alleged associates, who remains at large. The US State Department has announced a bounty of up to $11 million for information leading to Tymoshchuk's capture. He appears on wanted lists maintained by both the European Union and the FBI.
The US Justice Department charged Tymoshchuk in September for his roles as an administrator within the LockerGoga, MegaCortex, and Nefilim ransomware operations. Investigators allege his involvement in attacks that inflicted millions in damages across hundreds of organizations worldwide between July 2020 and October 2021.