A federal judge in Brooklyn has sentenced Artem Stryzhak, a 36-year-old Ukrainian national, to 70 months in prison for his part in ransomware attacks on hospitals, law firms, businesses and government bodies. US District Judge Pamela K. Chen handed down the sentence on Tuesday, 27 October, the US Attorney’s Office for the Eastern District of New York said.
The case closes one strand of a long international pursuit, but not the one prosecutors most want to finish. Stryzhak worked as an affiliate, renting other groups’ ransomware in exchange for a cut. The man the Justice Department names as one of his Nefilim bosses, Volodymyr Tymoshchuk, remains at large, and the US is still offering up to $11 million in rewards over him and others in that group.
In brief
- A Brooklyn judge sentenced Ukrainian Artem Stryzhak to 70 months for ransomware conspiracies involving Nefilim and Hive.
- The Justice Department says the conspiracies caused more than $100 million in losses; Hive alone hit about 1,500 victims.
- His alleged co-conspirator Volodymyr Tymoshchuk is still wanted, with State Department rewards of up to $11 million on offer.
Arrested in Spain, sentenced in Brooklyn
According to the Justice Department’s release, Stryzhak, formerly of Barcelona, was arrested in Spain in June 2024. The EDNY release says he was extradited to the United States on 30 April 2025. He pleaded guilty in December 2025 to two counts of conspiracy to commit fraud, extortion and related activity in connection with computers, under two Brooklyn docket numbers.
The investigation ran across several FBI offices. FBI Springfield handled the Nefilim case and FBI Tampa the Hive case, while the FBI’s New York Field Office, the Justice Department’s Office of International Affairs and Spanish police helped to find, arrest and extradite him.
“Today’s sentence reflects that cybercriminals cannot hide from law enforcement and will face significant punishment for their criminal conduct,” said US Attorney Joseph Nocella Jr. “We remain determined to capture Volodymyr Tymoshchuk, a serial ransomware developer and Stryzhak’s co-conspirator.”
The FBI’s Cyber Division posted on X that it is “seeking further information” on Tymoshchuk. Its post gives Stryzhak’s age as 35 and the term as “nearly six years”; both Justice Department releases say 36 and 70 months.
Two ransomware groups, one affiliate
Court documents cited by prosecutors say Stryzhak joined the Nefilim operation as an affiliate from about June 2021. He was given access to the ransomware and agreed to pay its administrators, including Tymoshchuk, 20% of whatever ransoms victims paid. That month he stole data from a company in the oil and gas transportation industry, then set up email addresses used in the ransom note sent to it. He kept deploying Nefilim until at least October 2021.
He separately joined Hive as one of its earliest affiliates. Prosecutors say Hive conspirators attacked about 1,500 victims worldwide between June 2021 and January 2023. Stryzhak and his co-conspirators deployed it against seven of them, including law firms, a dentist’s office and a healthcare provider during the Covid-19 pandemic. In one Hive attack the Justice Department describes, a hospital had to treat patients without its digital systems and could not take new patients straight away.
Defenders limited some of the damage. As part of its months-long campaign against Hive, the FBI gave one of Stryzhak’s victims a decryption key, letting it recover its data without paying. That campaign, announced in January 2023, saw the FBI hand more than 300 keys to victims under attack and more than 1,000 to earlier victims, averting about $130 million in ransom demands, before Hive’s servers were seized with German and Dutch police. The UK’s National Crime Agency and Spain’s PolicÃa Nacional were among the foreign agencies it credited with substantial assistance.
The State Department’s reward page for Tymoshchuk says he is charged in Brooklyn over the Nefilim, LockerGoga and MegaCortex ransomware, used against hundreds of companies between at least December 2018 and October 2021. It offers up to $10 million for information leading to his arrest or conviction, plus a separate offer of up to $1 million over other key leaders of those variants. The charges against him are allegations. A separate offer of up to $15 million covers Hive’s leaders and affiliates.
Affiliates are the replaceable part of ransomware
Stryzhak’s career shows why the ransomware-as-a-service model is so hard to stamp out. An affiliate does not need to write malware. He rents it, pays a share upstream and can work for more than one brand at the same time. Taking one affiliate off the board removes a pair of hands, but the developers who build and lease the tools can recruit another. That is why prosecutors spent as much of Tuesday talking about Tymoshchuk as about the man they had just sentenced.
The sentence still matters. Many of these cases end with an indictment and a wanted poster for someone beyond extradition. This one ended with a guilty plea and prison because Stryzhak was living in an EU country that would hand him over. For affiliates, that changes the calculation: working from abroad offers protection only so long as you stay somewhere that will not co-operate.
For organisations, the more practical lesson is in the decryption key. One of Stryzhak’s victims got its data back without paying because the FBI already held Hive’s keys. Victims who contact law enforcement early may find help that those who quietly pay never hear about. For compliance teams, the 20% split is also a reminder that a ransom does not stay with one criminal: it funds the developers behind the tool and the next wave of attacks.
The pursuit that continues
The sentence fits a steady run of US cyber prosecutions that end in prison terms for people who operated from abroad, such as the Nigerian man jailed for eight years over phishing hacks of US tax preparers, which TSN covered last week. Ransomware itself has not slowed: US, UK and other agencies recently warned that SafePay has hit at least 600 victims, and hospitals remain exposed, as the cyber event that diverted ambulances at UNM Health showed this week. Large co-ordinated operations are one answer, such as the Interpol-led African crackdown that made 1,462 arrests.
For Stryzhak’s case, the open question is Tymoshchuk. The State Department’s offer, and the FBI’s request for tips, remain open.
Sources
- US Department of Justice, Office of Public Affairs: “Ukrainian National Sentenced for Role in Hacking Hospitals, Businesses, and Governments as Part of Ransomware Conspiracies Causing Over $100 Million in Losses”, 27 October 2026
- US Attorney’s Office, Eastern District of New York: “Ukrainian National Sentenced to 70 Months in Prison for Multi-Million Dollar Ransomware Conspiracies”, 27 October 2026
- US Department of State, Transnational Organized Crime Rewards Program: Volodymyr Viktorovych Tymoshchuk
- US Department of State: Owners/Operators/Affiliates of the Hive Ransomware as a Service, 8 February 2024
- US Department of Justice: “U.S. Department of Justice Disrupts Hive Ransomware Variant”, 26 January 2023
- FBI Cyber Division on X, 27 October 2026
- US Attorney EDNY on X, 27 October 2026
Related stories
- Nigerian Man Gets Eight Years Over Spearphishing Hacks of US Tax Preparers
- SafePay Ransomware Has Hit at Least 600 Victims, FBI, CISA and UK Police Warn
- UNM Health Cyber Event Diverted Ambulances and Shut Clinics for a Day
- Interpol-Led Africa Crackdown Nets 1,462 Arrests and Recovers $105m
Follow @tsnmediahub on X for breaking AI news as it happens.
Follow on X
