Artem Stryzhak

Introduction

Artem Stryzhak, 36, a Ukrainian national formerly of Barcelona, Spain, was sentenced to 70 months in prison for conspiracy to commit computer fraud in connection with a series of ransomware attacks that targeted hospitals, government entities, law firms, and other businesses around the world — attacks the Justice Department says caused over $100 million in losses. Court documents show Stryzhak worked as an affiliate for two ransomware groups, Nefilim and Hive, beginning in approximately June 2021. He was arrested in Spain in June 2024, extradited to the United States in April 2025, and pleaded guilty in December 2025 to two counts of conspiracy to commit fraud, extortion, and related activity in connection with computers. The sentence was announced by the Justice Department on October 27, 2026.

Background Information

According to court documents, Stryzhak conspired with others to perpetrate ransomware attacks on behalf of multiple ransomware groups against victim computer networks in the United States and other countries, and the conspiracies caused significant damage to victim computer systems. Beginning in approximately June 2021, he joined the ongoing Nefilim conspiracy as a Nefilim ransomware affiliate, given access to the Nefilim ransomware. He agreed with one of the Nefilim ransomware group administrators, Volodymyr Tymoshchuk, to pay the Nefilim administrators, including Tymoshchuk, 20% of the ransom proceeds extorted from victims in exchange for his access to the Nefilim ransomware. Stryzhak separately joined the Hive ransomware group as one of its earliest affiliates; from June 2021 to January 2023, Hive conspirators attacked approximately 1,500 victims worldwide, including government entities, hospitals, and businesses. The affiliate model he worked under was straightforward: access to the ransomware in exchange for a fixed share of every ransom extracted.

The Controversy or Incident That Led to Their Cancellation

Convicted and sentenced. The attacks Stryzhak conducted with Nefilim ransomware included a June 2021 attack in which he stole data from a company in the oil and gas transportation industry; about a week later, he created email addresses that were incorporated in a ransom note sent to the victim company. Court documents state he conspired with the Nefilim ransomware actors until at least October 2021. If a victim paid the ransom demand, the perpetrators provided the decryption key, enabling the victim to decrypt files locked by the ransomware.

His record with Hive reached deeper into public life. Hive ransomware attacks caused major disruptions in victim daily operations around the world and affected responses to the COVID-19 pandemic; in one case, a hospital attacked by the Hive ransomware group had to forgo digital technology to treat existing patients and was unable to accept new patients immediately following the attack. In his role as a Hive affiliate, Stryzhak and his co-conspirators deployed Hive ransomware against seven victims, including law firms, a dentist office, and a healthcare provider, during the COVID-19 pandemic, leaving the victims unable to access their encrypted data. The FBI, as part of a months-long disruption campaign against the Hive ransomware group, provided a decryption key to one of Stryzhak’s victims, thereby allowing that victim to decrypt its encrypted data without having to pay a ransom.

Public Reaction and Consequences

“This sentence concludes a years-long, multi-continent investigation into a defendant who participated in cyber-attacks against Americans’ businesses and health care,” said Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division. “Artem Stryzhak’s sentence underscores the Justice Department’s resolve to dismantle ransomware groups, hold them accountable, and protect American businesses and people from cyber extortion.” U.S. Attorney Joseph Nocella Jr. for the Eastern District of New York said his office remains “determined to capture Volodymyr Tymoshchuk, a serial ransomware developer and Stryzhak’s co-conspirator.” Operations Director Brett Leatherman of the FBI’s Cyber Branch called Stryzhak “a prolific cybercriminal who worked with multiple ransomware groups to target U.S. businesses and hospitals,” noting that these groups “disrupted patient care and caused more than $100 million in losses.” The U.S. Department of State’s Transnational Organized Crime (TOC) Rewards Program has offered a reward of up to $11 million for information leading to the arrest and/or conviction or location of Stryzhak’s charged co-conspirator, Volodymyr Tymoshchuk.

Current Status

Stryzhak was arrested in Spain in June 2024, extradited to the United States in April 2025, and pleaded guilty in December 2025 to two counts of conspiracy to commit fraud, extortion, and related activity in connection with computers. On October 27, 2026, he was sentenced to 70 months in prison. The FBI Springfield Field Office investigated the Nefilim ransomware case and the FBI Tampa Field Office investigated the Hive ransomware case, with substantial assistance in locating, arresting, and extraditing him from the Criminal Division’s Office of International Affairs, the FBI’s New York Field Office, and Spanish law enforcement authorities. Acting Assistant Deputy Chief James S. Yoon of the Criminal Division’s Computer Crime and Intellectual Property Section (CCIPS), former CCIPS Senior Trial Attorney Brian Z. Mund, and Assistant U.S. Attorneys Alexander F. Mindlin and Ellen H. Sise of the Eastern District of New York’s National Security and Cybercrime Section prosecuted the Nefilim case; CCIPS Trial Attorneys Alison M. Zitron and Christen M. Gallagher and Assistant U.S. Attorney Hannah Watson of the Middle District of Florida prosecuted the Hive case.

Impact on Their Career/Life

Stryzhak’s run as an affiliate for hire — one who paid a 20% cut of ransoms to the Nefilim administrators for access to their ransomware and became one of Hive’s earliest affiliates — ended with a Spanish arrest, a transatlantic extradition, a guilty plea, and a 70-month federal sentence, while the hunt for his co-conspirators continues under an $11 million State Department reward. U.S. Attorney Gregory W. Kehoe for the Middle District of Florida said: “Disrupting a ransomware group that attacked approximately 1,500 victims worldwide and sentencing a defendant who had targeted healthcare during the COVID-19 pandemic is of significant importance to this office.” For the victims, the record is concrete: a hospital forced to forgo digital technology and turn away new patients, seven Hive victims unable to reach their own encrypted data, and one victim spared a ransom payment only because the FBI’s disruption campaign produced a decryption key.

Sources

U.S. Department of Justice, Office of Public Affairs, “Ukrainian National Sentenced for Role in Hacking Hospitals, Businesses, and Governments as Part of Ransomware Conspiracies Causing Over $100 Million in Losses” — source