Ukrainian national sentenced to 70 months for ransomware crimes

Artem Stryzhak was sentenced to 70 months in prison by a New York federal court for his role as an affiliate of the Nefilim and Hive ransomware gangs. Prosecutors believe he began working with Nefilim in or around June 2021 while living in Barcelona, Spain. He agreed with alleged Nefilim boss Volodymyr Tymoshchuk to pay the crew a 20 percent cut of ransom proceeds. Tymoshchuk instructed Stryzhak to target companies in the US, Canada, and Australia with annual revenues exceeding $100 million, later raising the preference to $200 million.

Stryzhak also signed up for the Hive ransomware operation as one of its earliest affiliates, using its platform to attack approximately seven victims. Hive operators claimed they targeted circa 1,500 victims worldwide between June 2021 and January 2023. An Ohio hospital victim of Hive paid approximately $1.7 million in Bitcoin after the gang initially demanded $2 million during the COVID-19 pandemic. FBI assistant director Brett Leatherman described Stryzhak as a "prolific cybercriminal" responsible for more than $100 million in victim damages.

Stryzhak was arrested by Spanish police in June 2024 before being extradited to the US in April 2025. The Justice Department announced rewards totaling up to $11 million for qualifying information about alleged Nefilim operator Volodymyr Tymoshchuk and other key ransomware suspects.