Artem Stryzhak, 36, a Ukrainian national, was sentenced today to 70 months in prison for conspiracy to commit computer fraud in connection with a series of ransomware attacks. The attacks targeted hospitals, government entities, law firms, and other businesses around the world.
According to court documents, Stryzhak, formerly of Barcelona, Spain, conspired with others to carry out ransomware attacks on behalf of multiple ransomware groups against victim computer networks in the United States and other countries. The conspiracies caused significant damage to victim computer systems.
The Nefilim Ransomware Conspiracy
Beginning in approximately June 2021, Stryzhak joined the ongoing Nefilim conspiracy as a Nefilim ransomware affiliate. He was given access to the Nefilim ransomware and agreed with one of the group's administrators, Volodymyr Tymoshchuk, to pay the Nefilim administrators, including Tymoshchuk, 20% of the ransom proceeds extorted from victims.
The attacks Stryzhak conducted with Nefilim included a June 2021 attack in which he stole data from a company in the oil and gas transportation industry. About a week later, he created email addresses that were incorporated in a ransom note sent to the victim company. Stryzhak conspired with the Nefilim ransomware actors until at least October 2021. If a victim paid the ransom demand, the perpetrators provided the decryption key, enabling the victim to decrypt files locked by the ransomware.
The Hive Ransomware Group
Stryzhak also separately joined the Hive ransomware group as one of its earliest affiliates. From June 2021 to January 2023, Hive conspirators attacked approximately 1,500 victims worldwide, including government entities, hospitals, and businesses. The attacks caused major disruptions in victims' daily operations around the world and affected responses to the COVID-19 pandemic. In one case, a hospital attacked by the group had to forgo digital technology to treat existing patients and was unable to accept new patients immediately following the attack.
As a Hive affiliate, Stryzhak and his co-conspirators deployed Hive ransomware against seven victims, including law firms, a dentist office, and a healthcare provider during the COVID-19 pandemic. Victims were unable to access their encrypted data. As part of a months-long disruption campaign against Hive, the FBI provided a decryption key to one of Stryzhak's victims, allowing that victim to decrypt its data without having to pay a ransom.
Arrest, Extradition and Guilty Plea
Stryzhak was arrested in Spain in June 2024 and extradited to the United States in April 2025. He pleaded guilty in December 2025 to two counts of conspiracy to commit fraud, extortion, and related activity in connection with computers.
"Cybercriminals who terrorize American businesses cannot evade justice by operating from abroad or hiding behind sophisticated technology," said Assistant Attorney General A. Tysen Duva of the Justice Department's Criminal Division.
"We remain determined to capture Volodymyr Tymoshchuk, a serial ransomware developer and Stryzhak's co-conspirator," said U.S. Attorney Joseph Nocella Jr. for the Eastern District of New York.
U.S. Attorney Gregory W. Kehoe for the Middle District of Florida said, "Disrupting a ransomware group that attacked approximately 1,500 victims worldwide and sentencing a defendant who had targeted healthcare during the COVID-19 pandemic is of significant importance to this office."
"Artem Stryzhak is a prolific cybercriminal who worked with multiple ransomware groups to target U.S. businesses and hospitals," said Operations Director Brett Leatherman of the FBI's Cyber Branch. "These groups disrupted patient care and caused more than $100 million in losses."
Investigating Agencies and Prosecutors
The FBI Springfield Field Office investigated the Nefilim ransomware case, and the FBI Tampa Field Office investigated the Hive ransomware case. The Criminal Division's Office of International Affairs, the FBI's New York Field Office, and Spanish law enforcement authorities provided substantial assistance locating, arresting, and extraditing Stryzhak.
Acting Assistant Deputy Chief James S. Yoon of the Criminal Division's Computer Crime and Intellectual Property Section (CCIPS), former CCIPS Senior Trial Attorney Brian Z. Mund, and Assistant United States Attorneys Alexander F. Mindlin and Ellen H. Sise of the Eastern District of New York's National Security and Cybercrime Section prosecuted the Nefilim case. CCIPS Trial Attorneys Alison M. Zitron and Christen M. Gallagher and Assistant United States Attorney Hannah Watson of the Middle District of Florida prosecuted the Hive case.
Reward Offered for Co-Conspirator
The U.S. Department of State's Transnational Organized Crime (TOC) Rewards Program has offered a reward of up to $11 million for information leading to the arrest and/or conviction or location of Stryzhak's charged co-conspirator, Volodymyr Tymoshchuk. Anyone with information about Tymoshchuk should contact the FBI via phone at +1-917-242-1407, by email at TymoTips@fbi.gov, by contacting a local field office if in the United States, or by contacting the nearest U.S. Embassy if located overseas. More information about the Tymoshchuk reward offer and one related to Hive ransomware is located on the State Department website.
CCIPS investigates and prosecutes cybercrime and intellectual property crime in coordination with domestic and international law enforcement agencies, often with assistance from the private sector. Since 2020, CCIPS has secured the conviction of over 180 cyber and IP criminals, and court orders for the return of over $350 million in victim funds.