Ukrainian national Artem Stryzhak was sentenced to 70 months in prison for his role as a ransomware affiliate with both the Nefilim and Hive groups, which prosecutors say caused more than $100 million in losses targeting hospitals and businesses across multiple countries.
A Ukrainian national who participated in ransomware attacks on hospitals, government agencies, and businesses across three countries was sentenced to 70 months in federal prison on October 27, a term that closes out a years-long, multi-continent investigation.
Artem Stryzhak, 36, of Ukraine, pleaded guilty in December 2025 to two counts of conspiracy to commit fraud, extortion, and related activity in connection with computers. He had been arrested in Spain in June 2024 and extradited to the United States last April.
Stryzhak operated as an affiliate of the Nefilim ransomware group throughout 2021, launching attacks on organizations in the United States, Canada, and Australia while living in Barcelona. Under that arrangement, he paid Nefilim administrators — including indicted co-conspirator Volodymyr Tymoshchuk — a 20% fee on all ransoms collected from victims.
He subsequently joined the Hive ransomware gang, working with that group from October 2021 to January 2023. Hive encrypted thousands of victims across 80 countries and earned millions in ransom payments during its run, according to prosecutors.
Stryzhak's activity with Hive included attacks on hospitals during the COVID-19 pandemic. In one incident cited by prosecutors, a hospital was rendered unable to accept new patients due to a Hive ransomware attack. The FBI later disrupted the Hive operation following a months-long undercover effort.
"Artem Stryzhak is a prolific cybercriminal who worked with multiple ransomware groups to target U.S. businesses and hospitals," said Assistant FBI Director Brett Leatherman. "These groups disrupted patient care and caused more than $100 million in losses."
Assistant Attorney General A. Tysen Duva characterized the sentence as the conclusion of a complex cross-border investigation. "This sentence concludes a years-long, multi-continent investigation into a defendant who participated in cyberattacks against Americans' businesses and health care," Duva said.
Tymoshchuk, the alleged Nefilim administrator, remains at large. Prosecutors have also accused him of serving as an administrator for the LockerGoga and MegaCortex ransomware gangs. The Department of Justice has issued an $11 million reward for information leading to his capture, along with a separate $15 million reward for information on other Hive members.
U.S. Attorney Joseph Nocella Jr. said authorities "remain determined to capture Volodymyr Tymoshchuk," signaling that the case is not fully closed despite Stryzhak's sentencing.
The Stryzhak case reflects a broader pattern in which U.S. authorities have pursued ransomware affiliates operating from abroad through extradition agreements with allied nations, underscoring the reach of American jurisdiction in transnational cybercrime prosecutions — even as core operators continue to evade arrest.
TechEchelon Staff bylines are produced collectively by the newsroom for short, breaking, and wire-style coverage. Longer-form reporting is published under the responsible reporter's name.
More from the Staff →The University of Copenhagen confirmed hackers accessed a test environment containing personal data for 525,000 people, including national identity numbers, with an additional 20,000 staff and student PIN codes also exposed.
Fifty-nine percent of U.S. employees say they are not fully prepared to spot modern payment scams, and only 23 percent say their company uses dedicated fraud-monitoring tools, according to research commissioned by payment-verification firm Eftsure.
A UEFI bootkit named BlackX, attributed with medium confidence to Chinese state-sponsored group APT41, exploited the Baton Drop vulnerability to bypass Secure Boot on fully patched Windows systems in a 2026 espionage campaign targeting Central Asian diplomatic agencies.
Written for readers who already know the basics — markets, AI, and the policy decisions that shape both.