Artem Stryzhak, 36, a Ukrainian national, was sentenced today to 70 months in prison for conspiracy to commit computer fraud in connection with a series of ransomware attacks that targeted hospitals, government entities, law firms, and other businesses around the world.
“This sentence concludes a years-long, multi-continent investigation into a defendant who participated in cyber-attacks against Americans’ businesses and health care,” said Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division. “Cybercriminals who terrorize American businesses cannot evade justice by operating from abroad or hiding behind sophisticated technology. Artem Stryzhak’s sentence underscores the Justice Department’s resolve to dismantle ransomware groups, hold them accountable, and protect American businesses and people from cyber extortion.”
“Ransomware attacks like those committed by the defendant wreak enormous havoc – harming victim companies that pay millions in remediation and ransoms, preventing hospitals and other critical facilities from accessing data, and putting sensitive information in the hands of bad actors,” said U.S. Attorney Joseph Nocella Jr. for the Eastern District of New York. “Today’s sentence reflects that cybercriminals cannot hide from law enforcement and will face significant punishment for their criminal conduct. We remain determined to capture Volodymyr Tymoshchuk, a serial ransomware developer and Stryzhak’s co-conspirator.”
“Disrupting a ransomware group that attacked approximately 1,500 victims worldwide and sentencing a defendant who had targeted healthcare during the COVID-19 pandemic is of significant importance to this office,” said U.S. Attorney Gregory W. Kehoe for the Middle District of Florida. “We are proud of our law enforcement partners for their skilled investigative work in bringing this criminal to justice.”
“Artem Stryzhak is a prolific cybercriminal who worked with multiple ransomware groups to target U.S. businesses and hospitals,” said Operations Director Brett Leatherman of the FBI’s Cyber Branch. “These groups disrupted patient care and caused more than $100 million in losses. Today’s sentence reflects the seriousness of Stryzhak’s crimes and demonstrates the FBI’s global reach and extensive network of international partners. Multiple field offices contributed to this investigation, and our work does not end here. We will continue to leverage every tool at our disposal to track down Stryzhak’s co-conspirators and hold them accountable, including Volodymyr Viktorovych Tymoshchuk.”
According to court documents, Stryzhak, formerly of Barcelona, Spain, conspired with others to perpetrate ransomware attacks on behalf of multiple ransomware groups against victim computer networks in the United States and other countries. The conspiracies caused significant damage to victim computer systems. Beginning in approximately June 2021, Stryzhak joined the ongoing Nefilim conspiracy as a Nefilim ransomware affiliate. Stryzhak was given access to the Nefilim ransomware and agreed with one of the Nefilim ransomware group administrators, Volodymyr Tymoshchuk, to pay the Nefilim administrators, including Tymoshchuk, 20% of the ransom proceeds extorted from victims in exchange for Stryzhak’s access to the Nefilim ransomware.
The ransomware attacks that Stryzhak conducted with Nefilim ransomware included a June 2021 attack in which Stryzhak stole data from a company in the oil and gas transportation industry. About a week later, Stryzhak created email addresses that were incorporated in a ransom note sent to the victim company. Stryzhak conspired with the Nefilim ransomware actors until at least October 2021. If a victim paid the ransom demand, the perpetrators provided the decryption key, enabling the victim to decrypt files locked by the ransomware.
Also according to court documents, Stryzhak separately joined the Hive ransomware group as one of its earliest affiliates. From June 2021 to January 2023, Hive conspirators attacked approximately 1,500 victims worldwide, including government entities, hospitals, and businesses. Hive ransomware attacks caused major disruptions in victim daily operations around the world and affected responses to the COVID-19 pandemic. In one case, a hospital attacked by the Hive ransomware group had to forgo digital technology to treat existing patients and was unable to accept new patients immediately following the attack.
In his role as a Hive affiliate, Stryzhak and his co-conspirators deployed Hive ransomware against seven victims, including law firms, a dentist office, and a healthcare provider during the COVID-19 pandemic. Victims were unable to access their encrypted data. The FBI, as part of a months-long disruption campaign against the Hive ransomware group, provided a decryption key to one of Stryzhak’s victims, thereby allowing that victim to decrypt its encrypted data without having to pay a ransom.
Stryzhak was arrested in Spain in June 2024 and extradited to the United States in April 2025. Stryzhak pleaded guilty in December 2025 to two counts of conspiracy to commit fraud, extortion, and related activity in connection with computers.
The FBI Springfield Field Office investigated the Nefilim ransomware case and the FBI Tampa Field Office investigated the Hive ransomware case. The Criminal Division’s Office of International Affairs, the FBI’s New York Field Office, and Spanish law enforcement authorities provided substantial assistance locating, arresting, and extraditing Stryzhak.
Acting Assistant Deputy Chief James S. Yoon of the Criminal Division’s Computer Crime and Intellectual Property Section (CCIPS), former CCIPS Senior Trial Attorney Brian Z. Mund, and Assistant United States Attorneys Alexander F. Mindlin and Ellen H. Sise of the Eastern District of New York’s National Security and Cybercrime Section prosecuted the Nefilim ransomware case. CCIPS Trial Attorneys Alison M. Zitron and Christen M. Gallagher and Assistant United States Attorney Hannah Watson of the Middle District of Florida prosecuted the Hive ransomware case.