A 36-year-old Ukrainian national was sentenced to prison in the US for his role in Nefilim ransomware attacks.
The man, Artem Aleksandrovych Stryzhak, who had been living in Barcelona, was arrested in Spain in June 2024 and extradited to the US in April 2025. He pleaded guilty in December 2025.
According to court documents, Stryzhak joined the Nefilim ransomware operation as an affiliate in June 2021 and used the malware in attacks against organizations in the US and abroad.
Stryzhak agreed with Nefilim administrator Volodymyr Tymoshchuk to pay the Nefilim administrators 20% of the ransom proceeds extorted from victims.
The defendant operated as a Nefilim ransomware affiliate between June 2021 and October 2021. One of his victims was an unnamed company in the oil and gas transportation industry.
Documents presented in court also show that Stryzhak was one of the early affiliates to join the Hive ransomware group, which hit over 1,500 victims worldwide between June 2021 and January 2023.
The documents show that Stryzhak used the Hive ransomware against seven victim organizations, including a dental office, a healthcare provider, and law firms. Some of the victims paid a ransom, and the cybercriminals provided a decryption key to recover the encrypted files.
Stryzhak was sentenced to 70 months in prison for conspiracy to commit computer fraud.
“Artem Stryzhak is a prolific cybercriminal who worked with multiple ransomware groups to target U.S. businesses and hospitals. These groups disrupted patient care and caused more than $100 million in losses,” FBI operations director Brett Leatherman said.
The US State Department is offering up to $10 million for information leading to the arrest or conviction of Tymoshchuk, who remains at large, and up to $1 million for information on other leaders of the ransomware groups he ran.
Related: Ransomware Response Expert Arrested in ShinyHunters FBI Hack Probe
Related: Fake Decryption Tools Masked $11M Markup in Ransomware Recovery Scheme
Related: Qilin Ransomware Suspect Arrested in Japan, Extradited to Germany
Related: Police Shut Down KillSec Ransomware, Identify Alleged Teen Leader
