A federal court on Tuesday sentenced Artem Stryzhak, a 36-year-old Ukrainian national, to 70 months in prison for his role in ransomware attacks on hospitals, government agencies, law firms and other businesses worldwide, according to the U.S. Department of Justice. Ransomware is software that locks a victim’s files until a ransom is paid.
Stryzhak was formerly of Barcelona, Spain. He pleaded guilty in December 2025 to two counts of conspiracy to commit fraud, extortion and related activity in connection with computers. The FBI said the ransomware groups he worked with caused more than $100 million in losses and disrupted patient care.
According to court documents, Stryzhak joined the Nefilim ransomware conspiracy as an affiliate in about June 2021. An affiliate is an outside partner who is given access to the ransomware. He agreed to pay the Nefilim administrators, including Volodymyr Tymoshchuk, 20% of the ransom money taken from victims.
The Justice Department said one Nefilim attack in June 2021 involved stolen data from a company in the oil and gas transportation industry. About a week later, Stryzhak created email addresses that were used in a ransom note sent to the company. He took part in the Nefilim conspiracy until at least October 2021, according to the department.
Court documents also say Stryzhak separately joined the Hive ransomware group as one of its earliest affiliates. From June 2021 to January 2023, Hive members attacked about 1,500 victims worldwide, including government entities, hospitals and businesses. In one case, a hospital hit by Hive had to stop using digital technology to treat current patients and could not immediately accept new ones.
Stryzhak and his co-conspirators used Hive ransomware against seven victims, the department said. They included law firms, a dentist office and a healthcare provider during the COVID-19 pandemic. As part of a months-long effort to disrupt Hive, the FBI gave a decryption key to one of Stryzhak’s victims, which let that victim unlock its data without paying.
Stryzhak was arrested in Spain in June 2024 and extradited to the United States in April 2025. The FBI’s Springfield and Tampa field offices investigated the Nefilim and Hive cases. Spanish law enforcement and other U.S. offices helped locate, arrest and extradite him.
Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division said the sentence shows the department’s resolve to dismantle ransomware groups and hold them accountable. U.S. Attorney Joseph Nocella Jr. for the Eastern District of New York said prosecutors remain determined to capture Tymoshchuk, whom he described as a serial ransomware developer.
The U.S. Department of State is offering a reward of up to $11 million for information leading to the arrest, conviction or location of Tymoshchuk, who is charged in the case. Charges are allegations, and defendants are presumed innocent unless proven guilty. The Justice Department release did not say where Tymoshchuk is believed to be.