Artem Stryzhak was sentenced to 70 months in federal prison for ransomware attacks as an affiliate of Nefilim and Hive.
In federal court in Brooklyn, United States District Judge Pamela K. Chen imposed the sentence.
In December 2025, Stryzhak pleaded guilty to conspiracy involving computer fraud, extortion and related activity connected with computers.
The 36-year-old Ukrainian national began working with Nefilim while living in Barcelona. He was taken into custody in Spain in June 2024 and sent to the United States in April 2025.
Stryzhak's attacks and Hive's reach
Stryzhak joined Nefilim as an affiliate in June 2021, working with its ransomware actors until at least October 2021. He agreed to give the administrators 20% of ransom proceeds extorted from victims.
From its early days, Hive’s affiliate network included him. The group struck about 1,500 victims worldwide from June 2021 through January 2023, including government entities, hospitals and businesses.
Among the seven Hive attacks linked to Stryzhak were operations against several law firms and a healthcare provider amid the COVID-19 pandemic. The provider was unable to take on new patients after the attack.
Hive's worldwide victim count describes the group's campaign. The case's seven attacks are the number attributed to Stryzhak. The sources differ on how to characterise losses exceeding $100 million: one account attributes them to Stryzhak, while others link them to the groups he worked with.
The FBI gave one of Stryzhak's victims a decryption key, allowing it to recover its data without paying a ransom.
Ransomware attacks like those committed by the defendant wreak enormous havoc—harming victim companies that pay millions in remediation and ransoms, preventing hospitals and other critical facilities from accessing data, and putting sensitive information in the hands of bad actors.
In 2022, an international law enforcement operation secretly penetrated Hive and passed decryption keys to victims. The U.S. Justice Department said the operation saved corporate victims more than $130 million in ransom payments.
In 2022, the U.S. Department of Health and Human Services said Hive posed an unusually severe danger to the health sector. Over 18 months, Hive had extorted $100 million from businesses and organisations worldwide, the FBI warned.
Stryzhak collaborated with several ransomware groups targeting U.S. businesses and hospitals, said Brett Leatherman, Operations Director of the FBI's Cyber Branch. Their attacks interfered with patient care and inflicted losses exceeding $100 million.
Artem Stryzhak is a prolific cybercriminal who worked with multiple ransomware groups to target US businesses and hospitals. These groups disrupted patient care and caused more than $100 million in losses. Today's sentence reflects the seriousness of Stryzhak's crimes and demonstrates the FBI's global reach and extensive network of international partners.
Co-conspirator remains at large
Stryzhak's co-conspirator, Volodymyr Viktorovych Tymoshchuk, remains at large. For information leading to Tymoshchuk's arrest, conviction or location, the U.S. Department of State is offering an $11 million reward.
On European Union and FBI most-wanted lists, Tymoshchuk has been charged in connection with multiple ransomware groups. The sources differ over how the reward is structured: some describe an offer of up to $11 million for information about Tymoshchuk, while another describes up to $10 million for information leading to his arrest or conviction and up to $1 million for information about other ransomware leaders.
Nocella said authorities remain determined to capture Tymoshchuk.
It's also unknown how many victims are directly attributable to Stryzhak and how much ransom he personally collected.
Today's sentence reflects that cybercriminals cannot hide from law enforcement and will face significant punishment for their criminal conduct. We remain determined to capture Volodymyr Tymoshchuk, a serial ransomware developer and Stryzhak's co-conspirator.
