A 36-year-old Ukrainian national has been sentenced to prison in the United States for his role in the Nefilim ransomware attacks.
The man, Artem Aleksandrovych Stryzhak, who lived in Barcelona, was arrested in Spain in June 2024 and extradited to the United States in April 2025. He pleaded guilty in December 2025.
According to court documents, Stryzhak joined the Nefilim ransomware operation as a subsidiary in June 2021 and used the malware in attacks against organizations in the United States and abroad.
Stryzhak agreed with Nefilim administrator Volodymyr Tymoshchuk to pay Nefilim administrators 20% of the ransom proceeds extorted from victims.
The accused operated as an affiliate of the Nefilim ransomware between June 2021 and October 2021. One of its victims was an unnamed company in the oil and gas transportation sector.
Documents presented to the court also show that Stryzhak was one of the first affiliates to join the Hive ransomware group, which claimed more than 1,500 victims worldwide between June 2021 and January 2023.
The documents show that Stryzhak used Hive ransomware against seven victim organizations, including a dental office, a healthcare provider, and law firms. Some victims paid ransom and cybercriminals provided decryption key to recover encrypted files.
Stryzhak was sentenced to 70 months in prison for conspiracy to commit computer fraud.
“Artem Stryzhak is a prolific cybercriminal who worked with multiple ransomware groups to target U.S. businesses and hospitals. These groups disrupted patient care and caused more than $100 million in losses,” said FBI Director of Operations Brett Leatherman.
The U.S. State Department is offering up to $10 million for information leading to the arrest or conviction of Tymoshchuk, who remains at large, and up to $1 million for information on other leaders of the ransomware groups he led.
Related: Ransomware Response Expert Arrested in FBI ShinyHunters Hacking Investigation
Related: Fake decryption tools mask $11 million markup in ransomware recovery program
Related: Qilin Ransomware Suspect Arrested in Japan and Extradited to Germany
Related: Police arrested KillSec ransomware, identified suspected teen leader
