Ukrainian National Sentenced to 70 Months in Prison for Multi

BROOKLYN, NY – Earlier today, in federal court in Brooklyn, Artem Stryzhak, a Ukrainian national, was sentenced by United States District Judge Pamela K. Chen to 70 months in prison for using ransomware to extort millions of dollars from victims. The defendant pled guilty in December 2025 to conspiracy to commit fraud, extortion, and related activity in connection with computers.

Joseph Nocella, Jr., United States Attorney for the Eastern District of New York; Gregory W. Kehoe, United States Attorney for the Middle District of Florida; A. Tysen Duva, Assistant Attorney General of the Justice Department’s Criminal Division; James C. Barnacle, Jr., Assistant Director in Charge, Federal Bureau of Investigation (FBI), New York Field Office; Ryan Presley, Special Agent in Charge, FBI, Springfield, Illinois Field Office; and Rodney Crawford, Special Agent in Charge, FBI, Tampa Florida Division announced the sentence.

“Ransomware attacks like those committed by the defendant wreak enormous havoc—harming victim companies that pay millions in remediation and ransoms, preventing hospitals and other critical facilities from accessing data, and putting sensitive information in the hands of bad actors,” stated United States Attorney Nocella. “Today’s sentence reflects that cybercriminals cannot hide from law enforcement and will face significant punishment for their criminal conduct. We remain determined to capture Volodymyr Tymoshchuk, a serial ransomware developer and Stryzhak’s co-conspirator.”

Mr. Nocella expressed his appreciation to the FBI’s New York Field Office for their significant contributions to the investigation. Mr. Nocella also thanked the Justice Department’s Office of International Affairs and Computer Crime and Intellectual Property Section (CCIPS), as well as Spanish law enforcement authorities, for their assistance in the capture of Stryzhak.

“Disrupting a ransomware group that attacked approximately 1,500 victims worldwide and sentencing a defendant who had targeted healthcare during the COVID-19 pandemic is of significant importance to this office,” said U.S. Attorney Kehoe for the Middle District of Florida. “We are proud of our law enforcement partners for their skilled investigative work in bringing this criminal to justice.”

“Artem Stryzhak chose to deploy ransomware that extorted money from victims, leaving businesses and individuals facing devasting losses. His actions serve as a strong reminder of the real-world damage cybercriminals can cause and underscore the FBI’s commitment to stopping these schemes and protecting the public,” stated FBI Assistant Director in Charge Barnacle.

“Cybercriminals who deploy ransomware inflict real and lasting damage on the communities we serve. The work leading to today’s sentence reflects the dedication of our agents and partners who spent years untangling a complex, transnational scheme,” stated FBI Springfield Special Agent in Charge Presley. “The FBI Springfield Field Office will continue to pursue actors who target U.S. networks and ensure they are held accountable. Our pursuit of Volodymyr Tymoshchuk remains ongoing, and we urge anyone with information to come forward.”

“Today’s action underscores the FBI’s steadfast commitment to pursuing cyber criminals wherever they operate. This case highlights the effectiveness with which multiple FBI field offices can coordinate to investigate sophisticated intrusions and impose real consequences for malicious activity,” stated FBI Tampa Division Special Agent in Charge Crawford. “The Tampa FBI Cyber Task Force remains dedicated to working with our domestic and international partners to identify cyber threat actors, disrupt their operations, and ensure justice for the individuals and organizations harmed by these crimes. Because of this collaboration, Stryzhak will be held responsible for his activities as an affiliate of Hive Ransomware.”

According to court documents, Stryzhak conspired with others to perpetrate ransomware attacks on behalf of multiple ransomware groups against victim computer networks in the United States and other countries, causing significant damage to victim computer systems. If a victim paid the ransom demand, the perpetrators provided the decryption key, enabling the victim to decrypt files locked by the ransomware.

Beginning in June 2021, Stryzhak joined the ongoing Nefilim conspiracy as a Nefilim ransomware affiliate. Stryzhak was given access to the Nefilim ransomware and agreed with one of the Nefilim ransomware group administrators, Volodymyr Tymoshchuk , to pay the Nefilim administrators 20% of the ransom proceeds extorted from victims in exchange for Stryzhak’s access to the Nefilim ransomware.

The ransomware attacks that Stryzhak conducted with Nefilim ransomware included a June 2021 attack in which Stryzhak stole data from a company in the oil and gas transportation industry. a week later, Stryzhak created email addresses that were incorporated in a ransom note sent to the victim company. Through at least October 2021, Stryzhak deployed Nefilim ransomware.

Further, Stryzhak separately joined the Hive ransomware group as one of its earliest affiliates. From June 2021 to January 2023, Hive conspirators attacked approximately 1,500 victims worldwide, including government entities, hospitals, and businesses. Hive ransomware attacks caused major disruptions in victim daily operations around the world and affected responses to the COVID-19 pandemic. In one case, a hospital attacked by the Hive ransomware group had to forgo digital technology to treat existing patients and was unable to accept new patients immediately following the attack.

In his role as a Hive affiliate, Stryzhak and his co-conspirators deployed Hive ransomware against seven victims including law firms, a dentist’s office, and a healthcare provider during the COVID-19 pandemic. Victims were unable to access their encrypted data. The FBI, as part of a months-long disruption campaign against the Hive ransomware group , provided a decryption key to one of Stryzhak’s victims, thereby allowing that victim to decrypt its encrypted data without having to pay a ransom.

Stryzhak was arrested in Spain in June 2024 and extradited to the United States on April 30, 2025.

The U.S. Department of State’s Transnational Organized Crime (TOC) Rewards Program has offered a reward of up to $11 million for information leading to the arrest and/or conviction or location of Stryzhak’s charged co-conspirator, Volodymyr Tymoshchuk. Anyone with information Tymoshchuk should the FBI via phone at +1-917-242-1407, by email at [email protected] , by contacting your local field office, if in the United States, or by contacting the nearest U.S. Embassy, if located overseas. More information the TOC reward offer is located on the State Department website Links to other government and non-government sites will typically appear with the “external link” icon to indicate that you are leaving the Department of Justice website when you click the link. .

The FBI Springfield Field Office investigated the Nefilim ransomware case and the FBI Tampa Field Office investigated the Hive ransomware case.

The government’s case is being handled by the Office’s National Security and Cybercrime Section. Assistant United States Attorneys Alexander F. Mindlin and Ellen H. Sise of the Eastern District of New York and Trial Attorney James S. Yoon of CCIPS are in charge of the Nefilim ransomware prosecution, with assistance from Paralegal Specialist Magdalena St. Surin. Former CCIPS Trial Attorney Brian Mund also worked on the case. The Hive ransomware case is being prosecuted by CCIPS Trial Attorneys Alison M. Zitron and Christen M. Gallagher, and by Assistant United States Attorney Hannah Watson of the Middle District of Florida; former Assistant United States Attorney Chauncey Bratt of the Middle District of Florida also worked on the case.

The Defendant : ARTEM ALEKSANDROVYCH STRYZHAK Age: 36 Barcelona, Spain E.D.N.Y. Docket Nos. 23-CR-324 (PKC), 25-CR-381 (PKC)

John Marzulli Denise Taylor United States Attorney’s Office (718) 254-6323