Prolific Ransomware Affiliate Sentenced to 70 Months for Global Attacks
Artem Stryzhak, a Ukrainian national, has been sentenced to 70 months in prison for his role in widespread ransomware attacks using Nefilim and Hive, impacting approximately 1,500 victims globally.
Artem Aleksandrovych Stryzhak, a 36-year-old Ukrainian national, has been sentenced to 70 months in prison for his involvement in a series of ransomware attacks that targeted critical infrastructure operators and businesses worldwide. The attacks, which spanned from mid-2018 to late 2021, saw Stryzhak participate in ransomware operations under the banners of prominent groups like Nefilim and Hive, affecting an estimated 1,500 victims across the globe.
Stryzhak's criminal activities included customizing ransomware executables for individual victims, creating unique decryption keys and ransom notes to maximize extortion. The Justice Department emphasized the severe disruption and financial losses caused by these operations, noting impacts on hospitals that disrupted patient care, government entities, and various private sector businesses, including law firms and companies in the oil and gas transportation industry. The Nefilim ransomware, in particular, was responsible for millions of dollars in losses due to extortion payments and network damage.
The prosecution highlighted that Stryzhak and his alleged co-conspirators meticulously researched their targets after breaching their networks. This reconnaissance phase involved determining the victim's net worth, size, and contact information to tailor their demands and threats. The ransomware group primarily focused on companies in the United States, Canada, and Australia with annual revenues exceeding $100 million, extorting them by threatening to publish stolen sensitive data.
Beyond North America, Stryzhak and his associates also deployed Nefilim ransomware against victims in Germany, the Netherlands, Norway, and Switzerland. During the COVID-19 pandemic, Stryzhak was identified as one of the early affiliates of the Hive ransomware, deploying it against at least seven victims. This extensive reach underscores the global nature of modern ransomware operations and the challenges in apprehending and prosecuting cybercriminals operating across borders.
Stryzhak pleaded guilty to multiple cybercrimes in late 2025. His arrest in Spain in June 2024 and subsequent extradition to the United States in April 2025 mark a significant international law enforcement success. Authorities are reportedly still searching for his alleged co-conspirator, Volodymyr Tymoshchuk, for whom a substantial reward has been offered.
U.S. Attorney Joseph Nocella Jr. stated that ransomware attacks like those committed by Stryzhak cause immense havoc, harming victim companies through remediation costs and ransom payments, disrupting essential services like hospitals, and putting sensitive information into the hands of malicious actors. The sentence serves as a stern warning to cybercriminals operating abroad.
Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division commented on the multi-continent investigation, asserting that cybercriminals who terrorize American businesses cannot evade justice by operating from abroad or hiding behind sophisticated technology. This case demonstrates the commitment of law enforcement agencies to pursue and prosecute individuals involved in transnational cybercrime, regardless of their location.
The conviction and sentencing of Stryzhak represent a notable success in the ongoing fight against ransomware. It highlights the effectiveness of international cooperation in cybercrime investigations and underscores the severe legal consequences faced by individuals who participate in such destructive activities, particularly those targeting critical infrastructure and essential services.