A U.S. court has issued a 70-month prison sentence to Ukrainian citizen Artem Aleksandrovych Stryzhak following his involvement in ransomware attacks carried out by the Nefilim and Hive groups. These attacks, which occurred between 2018 and 2021, targeted hospitals, government entities, and large-revenue companies worldwide.
Details of the Attacks and Criminal Activity
According to court documents, Stryzhak played a pivotal role as an "affiliate" in the criminal operations; he was responsible for paying 20% of all ransom amounts collected in exchange for obtaining customized Nefilim software and decryption keys starting from June 2021. His activities focused on targeting large companies in the United States, Canada, and Australia with annual revenues exceeding $100 million, and he even received instructions from group managers to raise the target ceiling to include companies with annual revenues exceeding $200 million.
The attackers used pressure tactics by threatening to leak stolen data on "Corporate Leaks" sites on the Dark Web unless the ransom was paid. Stryzhak was also involved in breaching and encrypting the systems of seven victims within the Hive group, including law firms and healthcare providers during the COVID-19 pandemic.
Legal Prosecution and Fugitive Partners
This sentence came after a complex extradition process, where Stryzhak was arrested in Spain in June 2024 and then extradited to U.S. authorities in April 2025. Stryzhak pleaded guilty to conspiracy to commit computer fraud charges related to attacks targeting several countries, including Norway, France, Switzerland, Germany, and the Netherlands.
In a related context, authorities are still pursuing another partner named Volodymyr Tymoshchuk, who is believed to have been an administrative official in the LockerGoga, MegaCortex, and Nefilim gangs. The U.S. Department of State has posted a reward of up to $11 million for information leading to his arrest.
What Does This Mean for Organizations and the Tech Sector?
This sentence reveals several critical technical and security facts:
- Targeting Sensitive Infrastructure: The targeting of hospitals during health crises (such as COVID-19) shows a dangerous shift in ransomware gang strategies toward victims who do not have the luxury of time, increasing the likelihood of ransom payments.
- Affiliate Model: The sentence demonstrates that ransomware gangs no longer operate as a single entity, but as networks of independent affiliates, making their tracking require extensive international cooperation.
- Effectiveness of International Cooperation: The extradition of the defendant from Spain to the United States represents a deterrent message, confirming that geographic scope no longer protects cybercriminals from legal prosecution.