Ransomware affiliate receives 70-month federal sentence
The case tied Artem Stryzhak to Nefilim and Hive attacks that disrupted hospitals, businesses and government organizations.
The sentence closes one part of a multinational investigation
A federal judge in Brooklyn has sentenced Ukrainian national Artem Stryzhak to 70 months in prison for two ransomware conspiracies. Stryzhak, 36, pleaded guilty in December 2025 to conspiracy counts involving computer fraud, extortion and related conduct. Spanish authorities arrested him in June 2024, and he was extradited to the United States in April 2025.
Justice Department records say Stryzhak joined the Nefilim operation as an affiliate in approximately June 2021. Affiliates obtained the malware and access to the group’s infrastructure, then shared a portion of successful ransom proceeds with administrators. Prosecutors said Stryzhak agreed to pay administrators 20 percent and participated in an attack on an oil-and-gas transportation business.
He later became an early affiliate of Hive, a ransomware-as-a-service group that attacked about 1,500 victims worldwide between June 2021 and January 2023. Court records attributed seven Hive deployments to Stryzhak and co-conspirators, including attacks on law firms, a dental office and a health-care provider during the COVID-19 pandemic.
Hospital disruption made the cybercrime physically consequential
Ransomware encrypts data and can also involve theft followed by threats to publish it. At one affected hospital, the Hive intrusion forced staff to operate without normal digital systems and temporarily prevented acceptance of new patients, according to the government’s account. That example shows why the case was treated as more than a dispute over computers or cryptocurrency.
The FBI had already infiltrated Hive’s network in 2022, obtained decryption keys and distributed them to victims. In January 2023, the Justice Department announced that the intervention had prevented more than $130 million in ransom demands and that law-enforcement partners had seized Hive servers and websites. One victim linked to Stryzhak received a key and restored its data without paying.
The department says the broader conspiracies produced more than $100 million in losses, a figure that includes damage across many victims and participants rather than a personal gain finding for Stryzhak. The sentence is final as to his conviction, while separate investigations and efforts to locate other alleged participants remain active.
The case illustrates the affiliate model
Ransomware groups often separate malware development, infrastructure and victim intrusion among different actors. That structure can expand the number of attacks and complicate attribution because an affiliate may deploy more than one group’s tools. The Stryzhak case connects conduct from two operations and relied on international arrest, extradition, digital evidence and cooperation among several FBI offices.
Federal officials continue to seek Volodymyr Tymoshchuk, described by prosecutors as a Nefilim administrator and Stryzhak co-conspirator. Charges against an absent defendant remain allegations unless proved in court. For organizations, the operational lesson remains basic but urgent: segmented backups, rehearsed downtime procedures and rapid reporting can limit harm while law enforcement pursues actors across borders. Those controls also give hospitals and public agencies a better chance to continue essential services during recovery.