A Ukrainian cybercriminal involved in the Nefilim and Hive ransomware operations has been sentenced to 70 months in a US federal prison. The case involved attacks on hospitals, government organizations, and businesses across several countries, with authorities linking the criminal operations to more than $100 million in losses.
Artem Aleksandrovych Stryzhak, 36, received his sentence on October 27, 2026, in a federal court in Brooklyn, New York. He had pleaded guilty in December 2025 to conspiracy charges involving computer fraud and extortion.
According to the US Department of Justice, Stryzhak began working with the Nefilim ransomware operation in June 2021. Under an agreement with the group’s administrators, including Volodymyr Tymoshchuk, he received access to ransomware tools in exchange for 20% of the ransom payments collected from victims.
The arrangement allowed Stryzhak to conduct attacks using malware developed by other criminals. Nefilim primarily targeted large businesses, stealing sensitive information and encrypting systems to pressure organizations into paying for decryption.
One documented attack involved a company operating in the oil and gas transportation sector. Prosecutors said Stryzhak stole information from the organization in June 2021 and subsequently helped prepare the ransom demand sent to the victim.
Stryzhak also became an early affiliate of Hive, another ransomware operation responsible for widespread disruption. Between June 2021 and January 2023, Hive attacked approximately 1,500 organizations worldwide, including hospitals, government agencies, and private companies.
Investigators connected Stryzhak and his accomplices to seven Hive attacks targeting organizations such as law firms, a dental practice, and a healthcare provider.
The consequences extended beyond financial losses. During the COVID-19 pandemic, one hospital attacked by Hive was forced to provide care without its usual digital systems and temporarily stopped accepting new patients.
The FBI later disrupted Hive through an international operation that included obtaining decryption keys. One of Stryzhak’s victims received a key from investigators, allowing the organization to recover encrypted files without paying the attackers.
Stryzhak was arrested in Spain in June 2024 and extradited to the United States in April 2025. His sentencing follows a multi-year investigation involving American and international law enforcement agencies.
Authorities are still searching for Tymoshchuk, who is accused of helping operate several ransomware groups, including Nefilim. The US State Department is offering a reward of up to $11 million for information leading to his arrest, conviction, or location.