A Ukrainian national has been sentenced to over five years in a U.S. prison for his involvement in a series of ransomware attacks linked to the Nefilim group. Artem Aleksandrovych Stryzhak, aged 36, faced justice following his extradition from Spain, where he was apprehended in June 2024. He was brought to the United States in April 2025 and entered a guilty plea by December of the same year.
Nefilim Ransomware Operations
Stryzhak’s affiliation with the Nefilim ransomware group began in June 2021. As an affiliate, he engaged in cyberattacks targeting organizations both within the United States and internationally. Court documents reveal that he entered into a profit-sharing agreement with Nefilim’s administrator, Volodymyr Tymoshchuk, where he would remit 20% of the extorted ransom funds to the group leaders.
Impact and Extent of Attacks
Operating as a Nefilim affiliate until October 2021, Stryzhak targeted various industries, including a notable case involving an unnamed oil and gas transportation company. Furthermore, his cybercriminal activities extended to the Hive ransomware group, known for its widespread impact on over 1,500 victims globally between mid-2021 and early 2023.
Among the seven organizations attacked using Hive ransomware were a dental practice, a healthcare facility, and several law firms. Victims who complied with ransom demands were subsequently provided with decryption keys to regain access to their encrypted data.
Legal Consequences and Ongoing Investigations
Stryzhak received a 70-month prison sentence for his role in the conspiracy to commit computer fraud. The FBI has emphasized the severity of his actions, noting the substantial disruption caused to U.S. businesses and healthcare systems, with financial damages exceeding $100 million. Brett Leatherman, the FBI’s operations director, highlighted the significant threat posed by Stryzhak and similar cybercriminals.
The U.S. State Department has offered substantial rewards for information leading to the arrest of Volodymyr Tymoshchuk, who remains at large, and other key figures in the ransomware operations. Rewards range up to $10 million for Tymoshchuk and up to $1 million for information on other leaders.
This case underscores the ongoing international efforts to combat ransomware and hold perpetrators accountable. The involvement of multiple nations in the arrest and extradition of cybercriminals like Stryzhak demonstrates the global commitment to cybersecurity and the protection of digital infrastructure.
