Artem Stryzhak, a Ukrainian national, received a 70-month prison sentence after entering a guilty plea.
He was an affiliate of the Nefilim ransomware group while residing in Barcelona, Spain. Throughout 2021, Stryzhak utilized Nefilim to execute attacks against entities in Australia, Canada, and the U.S.
Stryzhak paid Nefilim administrators, including indicted co-conspirator Volodymyr Tymoshchuk, a 20% fee of all ransom payments received from victims.
Subsequently, Stryzhak transitioned from Nefilim to join the Hive ransomware gang, operating with them from October 2021 until January 2023.
Assistant FBI Director Brett Leatherman stated, "Artem Stryzhak is a prolific cybercriminal who worked with multiple ransomware groups to target U.S. businesses and hospitals." He added, "These groups disrupted patient care and caused more than $100 million in losses."
The Hive ransomware gang encrypted thousands of victims across 80 nations and amassed millions through ransom payments during its active period.
Stryzhak was apprehended in Spain in June 2024 and subsequently extradited in April of the following year. He pleaded guilty in December 2025 to two counts of conspiracy to commit fraud, extortion, and related activity connected to computers.
Assistant Attorney General A. Tysen Duva remarked, "This sentence concludes a years-long, multi-continent investigation into a defendant who participated in cyberattacks against Americans’ businesses and health care."
Prosecutors continue their search for Tymoshchuk, who is also accused of serving as an administrator for the LockerGoga and MegaCortex ransomware gangs. U.S. Attorney Joseph Nocella Jr. affirmed they "remain determined to capture Volodymyr Tymoshchuk."
These enforcement actions demonstrate the persistent global reach of law enforcement bodies targeting sophisticated cybercriminal operations that directly impact critical infrastructure and commerce.
