Ukrainian ransomware affiliate sentenced to 70 months; $11 million reward offered for co-conspirator

Artem Stryzhak, a 36-year-old Ukrainian national formerly of Barcelona, Spain, received a 70-month sentence in U.S. prison. U.S. District Judge Pamela K. Chen imposed the term in Brooklyn on October 27, 2026. The sentence is five years and 10 months. In December 2025, he pleaded guilty to two conspiracy counts tied to fraud, extortion and computer-related activity.

Stryzhak was arrested in Spain in June 2024 and extradited to the United States in April 2025. The Criminal Division’s Office of International Affairs, the FBI’s New York Field Office and Spanish law enforcement helped locate, arrest and extradite him. The arrest and extradition preceded the guilty plea and sentencing. Cite: Help Net Security, FINCHANNEL, justice.gov

Around June 2021, Stryzhak became a Nefilim ransomware affiliate and received access to the group’s ransomware. Nefilim is a ransomware variant and affiliate program. He agreed with Nefilim administrator Volodymyr Tymoshchuk that administrators, including Tymoshchuk, would receive 20% of ransom proceeds from victims in exchange for access. His work with Nefilim actors continued until at least October 2021.

Cite: Help Net Security, FINCHANNEL, justice.gov, The Record

The Nefilim campaign aimed at corporations in the United States, Norway, France, Switzerland, Germany and the Netherlands. Nefilim targeted businesses in the United States, Canada and Australia with annual revenue over $100 million. In July 2021, a Nefilim administrator pressed Stryzhak to target companies in certain countries earning more than $200 million annually. The revenue threshold rose during the conspiracy.

Cite: Daily Security Review, Help Net Security

In June 2021, Stryzhak took data from a company in the oil and gas transportation business. About a week later, he set up email addresses that appeared in a ransom note to the company. It was one confirmed Nefilim-related attack. Cite: FINCHANNEL, justice.gov

Stryzhak also became an early Hive ransomware affiliate, working with the group from October 2021 to January 2023. Hive is a second named ransomware cartel in the case. Hive conspirators hit about 1,500 targets worldwide from June 2021 to January 2023, including government bodies, hospitals and companies. The broad scope of the Hive operation extended beyond Stryzhak’s personal victims.

Cite: FINCHANNEL, justice.gov, The Record

During the COVID-19 pandemic, Stryzhak and co-conspirators deployed Hive against seven victims, among them law firms, a dentist office and one healthcare provider. Those victims could not get to their encrypted data. One hospital hit by Hive had to drop digital tools for current patients and could not take new patients right away. Hive attacks badly disrupted daily operations for victims worldwide and got in the way of pandemic responses.

Cite: FINCHANNEL, justice.gov

The FBI provided a decryption key to one Hive victim during a months-long disruption campaign, letting the victim decrypt data without paying. International law enforcement dismantled Hive’s infrastructure in early 2023. The group is said to have collected more than $100 million from over 1,500 victims worldwide before the takedown. Cite: Help Net Security, FINCHANNEL, justice.gov, Asumetech

The FBI’s operations director, Brett Leatherman, said patient care was interrupted and losses topped $100 million. “These groups disrupted patient care and caused more than $100 million in losses,” Leatherman said. Cite: FINCHANNEL, justice.gov, The Record

The U.S. Attorney for the Middle District of Florida, Gregory W. Kehoe, said the sentence matters to his office because the defendant targeted healthcare during COVID-19. His office views the sentence as significant because the defendant targeted healthcare during the pandemic. Cite: Help Net Security, FINCHANNEL, justice.gov

The FBI’s Springfield Field Office worked the Nefilim case, while its Tampa Field Office handled the Hive case. The investigative work was divided between the two field offices. Cite: FINCHANNEL, justice.gov

James S. Yoon and Brian Z. Mund of CCIPS, along with Assistant United States Attorneys Alexander F. Mindlin and Ellen H. Sise, handled the Nefilim prosecution. The Hive prosecution was handled by CCIPS Trial Attorneys Alison M. Zitron and Christen M. Gallagher and Assistant United States Attorney Hannah Watson. Cite: FINCHANNEL, justice.gov

The State Department‘s Transnational Organized Crime Rewards Program offered up to $11 million. The reward seeks information leading to Tymoshchuk’s arrest, conviction or location. Investigators are still seeking Tymoshchuk, also named Volodymyr Viktorovych Tymoshchuk, who remains at large. Accusations also say Tymoshchuk administered the LockerGoga and MegaCortex ransomware cartels.

Cite: Help Net Security, FINCHANNEL, justice.gov, The Record

The Justice Department put up $15 million for information on other Hive members. A $10 million U.S. bounty followed the Conti ransomware cartel’s hacking of the Costa Rican government in mid-April. These are prior cyber-related bounty offers for comparison.