Artem Stryzhak, 36, received 70 months for conspiracy to commit computer fraud in connection with a series of ransomware attacks .
Stryzhak, formerly of Barcelona, Spain, conspired with others to perpetrate ransomware attacks on behalf of multiple ransomware groups against victim computer networks in the United States and other countries, according to court records.
The conspiracies caused significant damage to victim computer systems. Beginning in June 2021, Stryzhak joined the ongoing Nefilim conspiracy as a Nefilim ransomware affiliate, according to court records.
Stryzhak gained access to the Nefilim ransomware and agreed with one of the Nefilim ransomware group administrators, Volodymyr Tymoshchuk, to pay the Nefilim administrators, including Tymoshchuk, 20 percent of the ransom proceeds extorted from victims in exchange for Stryzhak’s access to the Nefilim ransomware, according to court records.
Oil and Gas Attack
The ransomware attacks Stryzhak conducted with Nefilim ransomware included a June 2021 attack where he stole data from a company in the oil and gas transportation industry. About a week later, Stryzhak created email addresses that were incorporated in a ransom note sent to the victim company, according to court records.
Stryzhak conspired with the Nefilim ransomware actors until at least October 2021. If a victim paid the ransom demand, the perpetrators provided the decryption key, enabling the victim to decrypt files locked by the ransomware.
Separately, Stryzhak joined the Hive ransomware group as one of its earliest affiliates, according to court records. From June 2021 to January 2023, Hive conspirators attacked 1,500 victims worldwide, including government entities, hospitals, and businesses.
Hive ransomware attacks caused major disruptions in victim daily operations around the world and affected responses to the COVID-19 pandemic. In one case, a hospital attacked by the Hive ransomware group had to forgo digital technology to treat existing patients and was unable to accept new patients immediately following the attack, according to court records.
In his role as a Hive affiliate, Stryzhak and his co-conspirators deployed Hive ransomware against seven victims, including law firms, a dentist office, and a healthcare provider during the COVID-19 pandemic, according to court records. Victims were unable to access their encrypted data.
“This sentence concludes a years-long, multi-continent investigation into a defendant who participated in cyberattacks against Americans’ businesses and health care,” said Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division. “Cybercriminals who terrorize American businesses cannot evade justice by operating from abroad or hiding behind sophisticated technology.”
Cost of Attack
“Ransomware attacks like those committed by the defendant wreak enormous havoc – harming victim companies that pay millions in remediation and ransoms, preventing hospitals and other critical facilities from accessing data, and putting sensitive information in the hands of bad actors,” said U.S. Attorney Joseph Nocella Jr. for the Eastern District of New York.
“Artem Stryzhak is a prolific cybercriminal who worked with multiple ransomware groups to target U.S. businesses and hospitals,” said Operations Director Brett Leatherman of the FBI’s Cyber Branch. “These groups disrupted patient care and caused more than $100 million in losses.”
FBI, as part of a months-long disruption campaign against the Hive ransomware group, provided a decryption key to one of Stryzhak’s victims, thereby allowing that victim to decrypt its encrypted data without having to pay a ransom.
Police arrested Stryzhak in Spain in June 2024 and ended up extradited to the United States in April 2025. Stryzhak pleaded guilty in December 2025 to two counts of conspiracy to commit fraud, extortion, and related activity in connection with computers.