U.S. court sentences Ukrainian hacker in ransomware case tied to more than $100 million in losses

Traders Union
All News
Regulators
Ukrainian hacker sentenced in ransomware case

Highlights

U.S. District Court sentences Artem Stryzhak to 70 months in prison for participating in ransomware attacks causing over $100 million in losses worldwide.
Stryzhak, an affiliate of Nefilim and Hive ransomware groups between June 2021 and January 2023, targets about 1,500 organizations globally, significantly disrupting healthcare and other sectors.
FBI disruption campaign against Hive enables agents to provide decryption keys to victims, illustrating ongoing U.S. pursuit of co-conspirators like Volodymyr Tymoshchuk.

Sentence follows years-long ransomware investigation

As reported by U.S. Department of Justice, Artem Stryzhak, 36, is sentenced to 70 months in prison for conspiracy to commit computer fraud tied to a series of ransomware attacks against hospitals, government entities, law firms and other businesses around the world.

Justice Department officials say the case concludes a multi-continent investigation into cyberattacks that hit U.S. businesses and healthcare providers. The department says Stryzhak took part in schemes that used ransomware to lock victims out of their systems and extort payments in exchange for decryption keys.

Court documents say Stryzhak, formerly of Barcelona, joined the Nefilim ransomware conspiracy around June 2021 as an affiliate. Prosecutors say he received access to the malware and agreed with administrator Volodymyr Tymoshchuk to pay Nefilim operators 20% of ransom proceeds in return for that access.

The filing says one June 2021 attack involved the theft of data from a company in the oil and gas transportation industry. About a week later, Stryzhak created email addresses used in a ransom note sent to the victim, and prosecutors say he remained involved with Nefilim until at least October 2021.

Healthcare disruption and broader cyber risk

Stryzhak also joins the Hive ransomware group as one of its earliest affiliates, according to court documents. From June 2021 to January 2023, Hive conspirators attack about 1,500 victims worldwide, including hospitals, government entities and businesses, with authorities saying the campaign causes major operational disruption and affects responses during the COVID-19 pandemic.

In one cited case, a hospital hit by Hive has to forgo digital technology to treat existing patients and is unable to accept new patients immediately after the attack. Prosecutors say Stryzhak and co-conspirators deploy Hive ransomware against seven victims, including law firms, a dentist office and a healthcare provider, leaving victims unable to access encrypted data.

The FBI says a months-long disruption campaign against Hive allows agents to provide a decryption key to one of Stryzhak's victims, helping that organization recover data without paying a ransom. Officials add that the investigation involves the FBI field offices in Springfield and Tampa, with support from Spanish law enforcement authorities in locating, arresting and extraditing Stryzhak.

Stryzhak is arrested in Spain in June 2024, extradited to the United States in April 2025 and pleads guilty in December 2025 to two counts of conspiracy to commit fraud, extortion and related computer offenses. U.S. prosecutors say efforts continue to pursue alleged co-conspirator Tymoshchuk.

Our earlier report on cybersecurity funding in Q3 highlighted that investor appetite stayed strong even as the number of deals fell, with larger late-stage rounds lifting total funding. We also noted that AI-driven security and identity-focused companies attracted the biggest checks, alongside a pickup in sector consolidation through major acquisitions.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.