A ransomware sentence handed down in Brooklyn on Tuesday, October 27, 2026, has put a number on one of the most disruptive cybercrime careers of recent years: Artem Aleksandrovych Stryzhak, a 36-year-old Ukrainian national, will spend 70 months — nearly six years — in federal prison for his part in ransomware conspiracies that struck hospitals, government offices, law firms and businesses in the United States and abroad, causing more than $100 million in losses. The case, prosecuted in the Eastern District of New York, is a rare public accounting of how ransomware-as-a-service actually worked at street level, with affiliates renting the malware, choosing the victims and handing a cut of every ransom to the operators behind the brand.
The sentence was imposed in federal court in Brooklyn, New York, where Stryzhak had pleaded guilty in December 2025. The two conspiracy counts covered fraud, extortion and related computer activity, and the 70-month term reflects a campaign that prosecutors traced across several years and several ransomware brands, rather than a single intrusion. Stryzhak, who had been living in Barcelona, Spain, was arrested there in June 2024 and extradited to the United States in April 2025, a sequence that itself illustrates how long international cyber cases can take to reach a courtroom: the last attacks attributed to him dated to 2021, and the superseding indictment in his case was filed in May 2024.
The Justice Department said on Tuesday that Stryzhak took part in a string of attacks on critical infrastructure operators and businesses from the middle of 2018 to late 2021. The victims named in reporting on the case included hospitals where attacks disrupted patient care, government entities, law firms, healthcare providers, a dentist office and a company in the oil and gas transportation industry. In the hospital cases, the human cost was the point prosecutors stressed most: when medical systems are encrypted, staff lose access to records, scheduling and communications, and care itself is delayed or diverted. Reporting on the wider Hive campaign described one hospital attack in which medical personnel were forced to work without their normal digital systems and the facility was temporarily unable to accept new patients.
As a Hive affiliate, Stryzhak and his co-conspirators deployed ransomware against seven victims, including law firms, a dental office and a healthcare provider, during the COVID-19 pandemic, when hospitals and clinics were already under extraordinary strain. The FBI later gave a decryption key to one of his victims, allowing that organisation to restore its data without paying the attackers — a reminder that not every victim in these cases pays, and that law enforcement disruption sometimes arrives in time to matter.
Ransomware is no longer, in most cases, the work of a lone hacker writing code in a bedroom. The dominant model of the past decade has been ransomware-as-a-service: a core group of developers builds and maintains the malware, runs the payment and leak infrastructure, and recruits affiliates who do the breaking in. Affiliates gain initial access to a victim network, steal sensitive data, deploy the ransomware to encrypt files, and then demand payment twice over — once for the decryption key, and again in exchange for not publishing the stolen data. That second threat, known as double extortion, is what made groups such as Nefilim and Hive especially feared: even a victim with good backups faced the prospect of its private data being posted online.
Nefilim emerged as one of the prominent double-extortion operations of 2020 and 2021. Its affiliates customised the ransomware executable for each victim, creating unique decryption keys and unique ransom notes, and they chose targets deliberately, researching companies after gaining network access to establish their revenues and contact details. The federal indictment described Nefilim being used against computer networks in the United States, Norway, France, Switzerland, Germany and the Netherlands, and reporting on the case said its affiliates focused on large companies, including firms in the United States, Canada and Australia with annual revenues above $100 million. Attacks involving Nefilim caused millions of dollars in losses from extortion payments and damage to victim networks, officials said.
Hive was larger still. A joint cybersecurity advisory issued by the FBI, the Cybersecurity and Infrastructure Security Agency and the Department of Health and Human Services in November 2022 documented Hive as a ransomware-as-a-service operation that heavily targeted critical infrastructure, including the Healthcare and Public Health sector. From June 2021 through January 2023, Hive actors attacked approximately 1,500 victims worldwide, and as of November 2022 federal authorities had identified more than 1,300 victim organisations and approximately $100 million in ransom payments associated with the group. Federal investigators eventually disrupted Hive's infrastructure and obtained decryption capabilities that let victims recover encrypted systems without paying ransom demands — one of the most consequential takedowns of that period.
Stryzhak's case is instructive precisely because he was not accused of writing the ransomware. He was an affiliate — in effect, a contractor who was given access to the malware and carried it into victim networks. Beginning around June 2021, he joined the Nefilim operation on that basis, agreeing to hand its administrators, including alleged co-conspirator Volodymyr Viktorovych Tymoshchuk, 20 percent of the ransom proceeds he obtained. In return he received bespoke ransomware and decryption keys, and he remained involved with the Nefilim conspiracy through at least October 2021. One attack attributed to him in June 2021 targeted a company in the oil and gas transportation industry: data was stolen from the company before ransom communications were prepared and sent to the victim, following the double-extortion playbook exactly.
He also became one of the earliest affiliates of Hive, a position that gave him access to a far larger victim pool just as that group was scaling up. The tactics documented across the Hive campaign read like a checklist of modern intrusion tradecraft: compromised remote-access credentials, phishing, exploitation of vulnerable internet-facing systems, disabling security tools, deleting Windows event logs, removing shadow copies that could have aided recovery, exfiltrating data and then encrypting victim systems. None of those steps required inventing new malware. They required patience, access and a willingness to press on when a victim's defences failed — which is why prosecutors treat affiliates as central figures rather than bit players, and why a 70-month sentence for an affiliate, rather than a developer, carries a deterrent message for the much larger pool of people who rent ransomware rather than build it.
The investigation itself crossed borders and agencies. The Nefilim case was investigated by the FBI's Springfield field office, the Hive case by the FBI's Tampa field office, with the FBI's New York field office, the Justice Department's Office of International Affairs and Spanish authorities assisting in locating, arresting and extraditing Stryzhak. The Nefilim case was prosecuted by Acting Assistant Deputy Chief James S. Yoon and former Senior Trial Attorney Brian Z. Mund of the Justice Department's Computer Crime and Intellectual Property Section, together with Assistant U.S. Attorneys Alexander F. Mindlin and Ellen H. Sise of the Eastern District of New York. The Hive case was prosecuted by trial attorneys Alison M. Zitron and Christen M. Gallagher, with Assistant U.S. Attorney Hannah Watson for the Middle District of Florida.
Joseph Nocella Jr., the U.S. Attorney for the Eastern District of New York, framed the sentence in terms of the damage ransomware does beyond the balance sheet. "Ransomware attacks like those committed by the defendant wreak enormous havoc — harming victim companies that pay millions in remediation and ransoms, preventing hospitals and other critical facilities from accessing data, and putting sensitive information in the hands of bad actors," Nocella said in a statement after the sentencing. The emphasis on hospitals and critical facilities echoed the Justice Department's account of the case, in which attacks on healthcare providers disrupted patient care at a time when those institutions could least afford it.
Brett Leatherman, Director of Cyber Branch Operations at the FBI, pointed to the international reach of the investigation. "Today's sentencing recognises the severity of Artem's crimes and highlights the FBI's global capabilities and extensive international partnerships," Leatherman said. The FBI's account also stressed that Stryzhak was an active cybercriminal working with several ransomware groups to target businesses and hospitals in America, disrupting patient care and causing over $100 million in losses. No statement from Stryzhak's defence was reported in the coverage of the sentencing, and the court record, rather than any public comment from the defendant, is now the last word on his part in the conspiracies.
This ransomware sentence matters for three reasons that go beyond one man's prison term. First, it confirms that American courts will pursue affiliates, not only the developers and administrators who run ransomware brands. The affiliate pool is far larger than the developer pool, and it is the affiliates who choose hospitals, clinics and local government offices as targets and who decide how hard to press a victim that is already in crisis. A sentence approaching six years for that role raises the personal cost of renting someone else's malware.
Second, the case is a measure of how seriously the United States now treats attacks on healthcare. Hive's targeting of the Healthcare and Public Health sector drew a joint advisory from the FBI, CISA and the Department of Health and Human Services precisely because encrypted hospital systems are not merely an IT problem: they delay treatment, divert ambulances and force clinicians back to paper in the middle of emergencies. Prosecutors made that argument explicitly, and the sentence follows a pattern of recent federal cases in which harm to patients and critical services weighs heavily in sentencing.
Third, the case shows both the reach and the limits of international enforcement. Stryzhak was found in Spain, extradited and sentenced in Brooklyn, and one victim received an FBI decryption key instead of paying. Yet his alleged administrator remains at large, with an $11 million reward outstanding, and the ransomware ecosystem that produced Nefilim and Hive has continued to evolve, with new brands replacing disrupted ones. The sentence closes one chapter; it does not close the market that made that chapter possible.
Stryzhak will now serve his 70-month federal sentence, with the usual questions of credit for time already spent in custody since his 2024 arrest and any supervised release to follow left to the court's judgment and federal sentencing rules. Attention in the wider case turns to Tymoshchuk, the alleged Nefilim administrator, who remains wanted. The State Department's Transnational Organized Crime Rewards Program is offering up to $11 million for information leading to his arrest, conviction or location, and reporting on the case has also noted a separate reward of up to $15 million covering other Hive members — a sign of how many threads of the Hive investigation remain open even after its infrastructure was disrupted.
For hospitals, local governments and mid-sized firms, the practical lessons are unchanged but urgent: segment networks so that one compromised credential does not unlock everything, keep offline backups that ransomware cannot reach, patch internet-facing systems promptly, and rehearse an incident response that assumes patient care or public services may have to continue without digital systems for days. The FBI's decryption help in this case was the exception, not the rule, and most victims of double-extortion attacks still face the same grim choice Stryzhak's victims faced: pay, rebuild, or watch stolen data leak. Watch too for further sentencings and extraditions arising from the Nefilim and Hive investigations, which involved multiple field offices and international partners and have already produced more than one prosecution.
Who is Artem Stryzhak? Artem Aleksandrovych Stryzhak is a 36-year-old Ukrainian national who had been living in Barcelona, Spain. He was an affiliate of the Nefilim and Hive ransomware groups, meaning he carried out attacks using their malware rather than developing it himself.
What sentence did he receive? On October 27, 2026, a federal court in Brooklyn sentenced him to 70 months — five years and ten months — in prison, after he pleaded guilty in December 2025 to two counts of conspiracy to commit fraud, extortion and related activity in connection with computers.
How much damage did the attacks cause? Prosecutors and the FBI put total losses from the Nefilim and Hive campaigns at more than $100 million. Hive alone attacked about 1,500 victims worldwide, with about $100 million in ransom payments identified as of November 2022, while Nefilim attacks caused millions of dollars in extortion payments and network damage.
Did any victims avoid paying? Yes, in at least one case. The FBI provided a decryption key to one of Stryzhak's victims, allowing that organisation to restore its data without paying. Federal investigators also disrupted Hive's infrastructure and obtained decryption capabilities for other victims.
Who is still wanted in this case? Volodymyr Viktorovych Tymoshchuk, Stryzhak's alleged Nefilim co-conspirator and an administrator of that operation, remains at large. The U.S. State Department is offering a reward of up to $11 million for information leading to his arrest, conviction or location.
Related coverage on US News Pulse: FEC cyberattack shuts down campaign finance filings days before midterms, Ohio auditor cyberattack: foreign actors blamed as state website goes offline, and FEC hacking attempt shuts down election agency systems before midterms.
Leave a Comment
| Today's Date:
