TAMPA, FL, Oct. 29, 2026 — A Ukrainian national who worked with two ransomware groups was sentenced Tuesday, Oct. 27, to 70 months in prison, the U.S. Department of Justice announced.[1]
Artem Stryzhak, 36, formerly of Barcelona, Spain, was sentenced for conspiracy to commit computer fraud in connection with ransomware attacks on hospitals, government entities, law firms and other businesses, according to the department.[1] He pleaded guilty in December 2025 to two counts of conspiracy to commit fraud, extortion and related activity in connection with computers.[1]
The FBI Tampa Field Office investigated the Hive part of the case, and an assistant U.S. attorney from the Middle District of Florida helped prosecute it alongside Justice Department cybercrime attorneys, the department said.[1]
What prosecutors say happened
Ransomware is malicious software that locks a victim's files until a ransom is paid.
According to court documents cited by the Justice Department, Stryzhak joined the Nefilim ransomware conspiracy as an "affiliate" around June 2021. He agreed to pay Nefilim's administrators 20% of the ransoms he collected in exchange for access to the ransomware.[1] In one June 2021 attack, he stole data from a company in the oil and gas transportation industry, the department said.[1]
Separately, he joined the Hive ransomware group as one of its earliest affiliates, according to the department. From June 2021 to January 2023, Hive conspirators attacked about 1,500 victims worldwide, the Justice Department said. In one case, a hospital hit by Hive "had to forgo digital technology to treat existing patients and was unable to accept new patients immediately following the attack."[1]
As a Hive affiliate, Stryzhak and others deployed the ransomware against seven victims, including law firms, a dentist office and a health care provider during the COVID-19 pandemic, the department said. During a months-long disruption campaign, the FBI gave one of his victims a decryption key, which let it unlock its data without paying a ransom.[1]
Brett Leatherman, operations director of the FBI's Cyber Branch, said the groups "disrupted patient care and caused more than $100 million in losses."[1]
Arrest and extradition
Stryzhak was arrested in Spain in June 2024 and extradited to the U.S. in April 2025, according to the department. Spanish law enforcement authorities were among those who helped locate, arrest and extradite him.[1]
What officials said
"Disrupting a ransomware group that attacked approximately 1,500 victims worldwide and sentencing a defendant who had targeted healthcare during the COVID-19 pandemic is of significant importance to this office," said U.S. Attorney Gregory W. Kehoe for the Middle District of Florida.[1]
Co-defendant still sought
Another man charged in the case, Volodymyr Tymoshchuk, hasn't been caught. The Justice Department describes him as a Nefilim administrator. He's charged, not convicted, and is presumed innocent unless proven guilty in court.[1]
The State Department has offered a reward of up to $11 million for information leading to Tymoshchuk's arrest, conviction or location. The FBI asks anyone with information to email [email protected] or call +1-917-242-1407.[1]
Those are the facts, directly from the source.
Sources
- U.S. Department of Justice, Office of Public Affairs, "Ukrainian National Sentenced for Role in Hacking Hospitals, Businesses, and Governments as Part of Ransomware Conspiracies Causing Over $100 Million in Losses," Oct. 27, 2026. https://www.justice.gov/opa/pr/ukrainian-national-sentenced-role-hacking-hospitals-businesses-and-governments-part
← More Crime stories · All Launchpad stories · Spotted an error? Request a correction.