A Ukrainian ransomware affiliate has been sentenced to 70 months in prison for participating in cyberattacks against hospitals, businesses, law firms and government entities across multiple countries. Artem Stryzhak, 36, was sentenced in the United States for his role in ransomware conspiracies linked to more than $100 million in losses, according to the U.S. Department of Justice (DOJ).
Stryzhak worked with the Nefilim ransomware and Hive ransomware groups, targeting computer networks and disrupting operations across different sectors. The attacks included incidents affecting healthcare providers during the COVID-19 pandemic, when hospitals faced disruptions to their ability to access digital systems and treat patients.
Ukrainian Ransomware Affiliate Linked to Two Groups
According to court documents, Stryzhak joined the Nefilim ransomware operation around June 2021 as an affiliate. He received access to the group’s ransomware under an arrangement with administrator Volodymyr Tymoshchuk and agreed to pay the administrators 20% of the ransom proceeds collected from victims.
One documented attack took place in June 2021, when Stryzhak stole data from a company operating in the oil and gas transportation industry. About a week later, he created email addresses that were incorporated into a ransom note sent to the company.
The attackers used ransomware to encrypt victims’ files and demanded payment. If a victim paid, the perpetrators provided a decryption key to restore access to the locked data.
Stryzhak remained involved in the Nefilim conspiracy until at least October 2021, court records state.
He separately joined the Hive ransomware group as one of its earliest affiliates. Between June 2021 and January 2023, Hive conspirators attacked approximately 1,500 victims worldwide, including government entities, hospitals and businesses.
Hive Ransomware Attacks Disrupted Hospital Operations
The Hive ransomware operation caused significant disruption to organizations, including healthcare facilities responding to the COVID-19 pandemic.
According to the DOJ, one hospital targeted by the group had to stop relying on digital technology to treat existing patients and was temporarily unable to accept new patients immediately following the attack.
As a Hive affiliate, Stryzhak and his co-conspirators deployed ransomware against seven victims. These included law firms, a dental office and a healthcare provider during the pandemic.
The attacks left victims unable to access encrypted data, affecting their day-to-day operations.
The FBI had previously conducted a months-long disruption campaign against Hive. During that effort, investigators obtained a decryption key and provided it to one of Stryzhak’s victims, enabling the organization to recover its encrypted data without paying a ransom.
FBI Investigation Spanned Multiple Countries
The investigation involved several FBI field offices and international law enforcement partners.
The FBI Springfield Field Office investigated the Nefilim ransomware case, while the FBI Tampa Field Office investigated the Hive operation. The FBI’s New York Field Office, the Justice Department’s Office of International Affairs and Spanish law enforcement authorities also assisted in locating, arresting and extraditing Stryzhak.
He was arrested in Spain in June 2024 and extradited to the United States in April 2025. In December 2025, he pleaded guilty to two counts of conspiracy involving fraud, extortion and related activity connected to computers.
The sentence follows a broader effort by U.S. authorities to pursue ransomware affiliates and their associates, including individuals operating outside the country.
$11 Million Reward Offered for Co-Conspirator
Authorities are continuing to seek Volodymyr Viktorovych Tymoshchuk, identified by prosecutors as Stryzhak’s co-conspirator and a ransomware developer.
The U.S. Department of State’s Transnational Organized Crime Rewards Program is offering up to $11 million for information leading to Tymoshchuk’s arrest and/or conviction or location.
Individuals with information can contact the FBI at +1-917-242-1407, email [email protected], contact a local FBI field office in the United States or approach the nearest U.S. Embassy overseas.
The DOJ’s Computer Crime and Intellectual Property Section, which investigates and prosecutes cybercrime in coordination with domestic and international partners, has secured more than 180 convictions involving cybercrime and intellectual property offenses since 2020. The department also reports obtaining court orders for the return of more than $350 million in victim funds during that period.
Stryzhak’s sentence highlights the consequences for individuals who participate in ransomware operations that target critical services and businesses. The investigation into his alleged co-conspirators remains ongoing.
