“Ransomware attacks like those committed by the defendant wreak enormous havoc — harming victim companies that pay millions in remediation and ransoms, preventing hospitals and other critical facilities from accessing data, and putting sensitive information in the hands of bad actors,” Joseph Nocella Jr., U.S. attorney for the Eastern District of New York, said in a statement.
Sentence, plea, and cross-border custody
A 36‑year‑old Ukrainian national, Artem Aleksandrovych Stryzhak, was sentenced to 70 months in prison for his role in a series of ransomware attacks that prosecutors say ran from mid‑2018 through late 2021. Stryzhak pleaded guilty to multiple cybercrimes in late 2025, was arrested in Spain in June 2024, and was extradited to the United States in April 2025, the Justice Department said.
Scope of attacks and named victims
Prosecutors linked Stryzhak to ransomware intrusions that hit hospitals and disrupted patient care, government entities, a dentist’s office, a company in the oil and gas transportation sector, and law firms. Officials said the Nefilim ransomware family — one of the groups Stryzhak joined — caused “millions of dollars in losses from extortion payments and damage to victim networks.”
U.S. victims named by prosecutors include an engineering consulting company based in France, an aviation industry company in New York, a chemical company in Ohio, an insurance company in Illinois, a construction‑industry company in Texas, a pet care company in Missouri, and an international eyewear company. Prosecutors also said Stryzhak and his co‑conspirators used Nefilim ransomware to encrypt victim networks in Germany, the Netherlands, Norway and Switzerland.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleAffiliations with Nefilim and Hive and operational detail
Stryzhak joined multiple ransomware groups during the period prosecutors describe, including Nefilim and Hive. The source material says Hive and Nefilim together “attacked about 1,500 victims worldwide.” Authorities described Stryzhak as one of the earliest Hive affiliates and said he and co‑conspirators deployed that ransomware against seven victims during the COVID‑19 pandemic.
Prosecutors allege operational tradecraft that included customizing executable ransomware files for each victim, producing unique decryption keys and unique ransom notes. The crew is accused of researching companies after breaking into their networks to determine net worth, size and contact information, then targeting predominantly companies located in the United States, Canada and Australia with more than $100 million in annual revenue and extorting victims by threatening to publish stolen data.
Co‑conspirators, reward, and prosecutor statements
Authorities continue to seek an alleged co‑conspirator, Volodymyr Tymoshchuk, and previously announced an $11 million reward for information leading to his arrest or conviction. The Justice Department statements framed the sentence as the culmination of a years‑long, multi‑continent investigation. “This sentence concludes a years‑long, multi‑continent investigation into a defendant who participated in cyberattacks against Americans’ businesses and health care,” A. Tysen Duva, assistant attorney general of the Justice Department’s Criminal Division, said in a statement. “Cybercriminals who terrorize American businesses cannot evade justice by operating from abroad or hiding behind sophisticated technology.”
What this means for technologists, affected enterprises, and health care providers
- Technologists and security teams: The reported use of per‑victim customized executables, unique decryption keys and distinct ransom notes underscores investigators’ findings that attackers increasingly tailor malware and extortion strategies to individual targets — a detail that complicates one‑size‑fits‑all decryption or remediation approaches.
- Affected enterprises and procurement leaders: Prosecutors say the crew targeted organizations with more than $100 million in annual revenue and researched net worth and contacts after initial access, signaling an emphasis on high‑value targets and post‑intrusion intelligence gathering when attackers calculate ransom demands.
- Hospitals and health care providers: The sentence draws attention to incidents prosecutors listed that disrupted patient care, an explicit reminder in the record that certain attacks carried consequences beyond financial loss.
The sentence closes a chapter in a transnational investigation that moved from a June 2024 arrest in Spain to an April 2025 extradition and a late‑2025 guilty plea. It leaves open at least one high‑profile question recorded in the public notice of the case: authorities are still seeking Volodymyr Tymoshchuk, and an $11 million reward for information about him remains in place.
