Ukrainian Nefilim affiliate gets 70 months for ransomware spree against hospitals and firms

Key points

• Artem Stryzhak, a 35-year-old Ukrainian national, was sentenced to 70 months in US federal prison for his part in Nefilim ransomware attacks on hospitals, law firms and large companies.
• The FBI says the ransomware crews Stryzhak worked with caused more than $100 million in losses to victims worldwide.
• Stryzhak kept 20% of every ransom paid by companies he broke into as a Nefilim affiliate, starting in June 2021.
• He was arrested in Spain in June 2024, extradited to the US on 30 April 2025, and pleaded guilty in December 2025.
• Volodymyr Tymoshchuk, an alleged accomplice still at large, has a $11 million US State Department bounty on his arrest.

A Ukrainian man who hunted big companies for a ransomware gang is going to prison in the United States for nearly six years.

Artem Stryzhak, 35, was sentenced in a Brooklyn federal court for conspiracy to commit computer fraud. Ransomware is malicious software that scrambles a company's files, then demands payment for the decryption key. Stryzhak worked with crews called Nefilim and Hive, which prosecutors say hit hospitals, government offices and large businesses from 2018 to 2021.

Who is Artem Stryzhak and what did he do?

Stryzhak was a paid affiliate: he rented ransomware built by other criminals and took a cut of whatever victims paid. From June 2021 he kept 20% of every ransom collected on Nefilim attacks. His targets weren't small shops. A Nefilim administrator later pushed him toward companies pulling in more than $200 million a year, up from an earlier floor of $100 million. To squeeze payments out of victims, the gang ran a dark-web site called "Corporate Leaks" where it threatened to publish stolen files if a company refused to pay.

As a Hive affiliate, Stryzhak broke into seven victims during the COVID-19 pandemic, including a dentist's office and several healthcare providers, according to court documents.

How did police catch him?

Spanish police arrested Stryzhak in June 2024. He was flown to the United States on 30 April 2025 and pleaded guilty in December 2025 to charges brought in the Eastern District of New York. This is the third extradition case we've covered in the last 90 days; our story on the Scattered Spider suspect extradited from Finland on 1 July 2026 shows how steadily that pipeline has been moving.

FBI Cyber Branch Operations Director Brett Leatherman said the groups Stryzhak worked with "disrupted patient care and caused more than $100 million in losses."

One alleged accomplice is still free. The US State Department is offering up to $11 million for information leading to the arrest of Volodymyr Tymoshchuk, another Ukrainian national, who prosecutors say helped administer LockerGoga, MegaCortex and a third gang. Tymoshchuk is on FBI and EU most-wanted lists.

Case at a glance

Should hospital patients and customers be worried today?

Not about Stryzhak himself. Nefilim and Hive were dismantled years ago, and he'll spend the next several years in a US prison. The affiliate model he used is the problem that outlasts him. New crews keep appearing with the same playbook: break in, steal files, scramble the systems, threaten to publish the data. We covered a near-identical structure in September when a Ukrainian Conti member drew four years for extorting a dozen companies, and the economics haven't changed.

My read: a 70-month sentence for someone who personally profited from attacks on hospitals during a pandemic is a real result, and the extradition from Spain is the detail other affiliates should sit with. The underlying business is still open for hire, though. Watch what happens to Tymoshchuk.