Artem Aleksandrovych Stryzhak, a 36-year-old Ukrainian national, was sentenced to 70 months in prison on October 27, 2026, for his role in global ransomware campaigns that caused more than $100 million in losses. Operating as an affiliate for the Nefilim and Hive ransomware groups, Stryzhak targeted critical infrastructure, including hospitals, law firms, and government agencies.
United States District Judge Pamela K. Chen delivered the sentence in a Brooklyn federal court. The judgment follows a multi-year international investigation that saw Stryzhak arrested in Barcelona, Spain, in June 2024 and extradited to the United States in April 2025. He previously pleaded guilty to conspiracy to commit wire fraud in December 2025.
The Department of Justice detailed that Stryzhak acted as a prolific affiliate, managing the deployment of ransomware and negotiating with victims. Under the “ransomware-as-a-service” model used by Nefilim, Stryzhak typically paid 20% of his extorted proceeds to the group’s administrators in exchange for access to the malicious software and the infrastructure required to leak stolen data.
The real-world consequences of these attacks were particularly severe during the COVID-19 pandemic. In one documented instance, a hospital targeted by Hive was forced to stop accepting new patients and revert to manual, non-digital operations because its records were encrypted. Beyond medical facilities, the affiliate’s victims included a dentist’s office and various local government entities.
The Hive ransomware group, which Stryzhak supported until at least January 2023, was known for a “double extortion” tactic. This involved not only encrypting a victim’s files but also threatening to publish sensitive data on a public leak site if the ransom was not paid. Before the Hive infrastructure was dismantled by international law enforcement in early 2023, the group had reportedly extorted more than $100 million from over 1,500 victims worldwide.
While Stryzhak’s sentencing marks a conclusion for one major participant, federal authorities are still pursuing his alleged co-conspirator. The U.S. State Department currently offers a reward of up to $11 million for information leading to the arrest or conviction of Volodymyr Viktorovych Tymoshchuk.
Tymoshchuk is described by investigators as a developer and administrator who played a central role in the Hive operation. Law enforcement officials emphasized that the conclusion of Stryzhak’s case serves as a warning that affiliates of major ransomware syndicates remain high-priority targets, regardless of where they are located.
