Ukrainian National Sentenced to 70 Months for Ransomware Attacks on Hospitals and Governments Causing Over $100 Million in Losses
The U.S. Department of Justice announced on October 27 that Artem Stryzhak, 36, a Ukrainian national, was sentenced to 70 months in prison for conspiracy to commit computer fraud in connection with a series of ransomware attacks that targeted hospitals, government entities, law firms and other businesses around the world. The Justice Department said the ransomware groups he worked with caused more than $100 million in losses.
According to court documents, Stryzhak, formerly of Barcelona, Spain, joined the Nefilim ransomware conspiracy in June 2021 as an affiliate. He was given access to the Nefilim ransomware and agreed to pay the group's administrators, including Volodymyr Tymoshchuk, 20 percent of the ransom proceeds. His Nefilim attacks included a June 2021 intrusion in which he stole data from a company in the oil and gas transportation industry and, about a week later, created email addresses used in a ransom note sent to that company.
Stryzhak also joined the Hive ransomware group as one of its earliest affiliates. From June 2021 to January 2023, Hive conspirators attacked approximately 1,500 victims worldwide, including government entities, hospitals and businesses, causing major disruptions and affecting responses to the COVID-19 pandemic; in one case, a hospital attacked by Hive had to forgo digital technology to treat existing patients and could not accept new patients immediately after the attack. Stryzhak and his co-conspirators deployed Hive against seven victims, including law firms, a dentist office and a healthcare provider. During a months-long disruption campaign, the FBI provided a decryption key to one of his victims, who recovered their data without paying a ransom.
Stryzhak was arrested in Spain in June 2024 and extradited to the United States in April 2025. He pleaded guilty in December 2025 to two counts of conspiracy to commit fraud, extortion and related activity in connection with computers. The FBI Springfield Field Office investigated the Nefilim case and the FBI Tampa Field Office investigated the Hive case, with prosecutions led by the Eastern District of New York and the Middle District of Florida together with the Justice Department's Criminal Division.
Assistant Attorney General A. Tysen Duva of the Criminal Division said the sentence concludes a years-long, multi-continent investigation and shows that cybercriminals cannot evade justice by operating from abroad. U.S. Attorney Joseph Nocella Jr. said prosecutors remain determined to capture Tymoshchuk, described as a serial ransomware developer and Stryzhak's co-conspirator. The State Department's Transnational Organized Crime Rewards Program has offered up to $11 million for information leading to Tymoshchuk's arrest, conviction or location.
Source: GSM · USA (original Chinese edition)
Photo: 图：位于华盛顿的美国司法部总部大楼。CC BY-SA 3.0，来源：Wikimedia Commons / Photo: U.S. Department of Justice headquarters in Washington, D.C. CC BY-SA 3.0, via Wikimedia Commons.
