Ukrainian Ransomware Affiliate Sentenced to 70 Months Following International Extradition
A 36-year-old Ukrainian national has been sentenced to 70 months in a U.S. federal prison for his role as an active affiliate in two prominent ransomware operations. Artem Aleksandrovych Stryzhak, who was arrested in Spain in June 2024 and subsequently extradited to the United States in April 2025, pleaded guilty in December 2025 to charges related to his participation in the Nefilim and Hive ransomware schemes.
A Multi-Group Ransomware Affiliate
Court documentation reveals that Stryzhak’s involvement in illicit cyber activities spanned several years, during which he collaborated with multiple threat groups to target critical infrastructure and private sector entities. Between June 2021 and October 2021, Stryzhak operated as an affiliate for the Nefilim ransomware group. Under an agreement with the group’s administrator, Volodymyr Tymoshchuk, Stryzhak was responsible for executing attacks, with a commitment to remit 20% of all extorted proceeds back to the group’s leadership.
During this period, his activities included targeting organizations within the oil and gas transportation sector. Beyond his work with Nefilim, court records indicate that Stryzhak was among the early wave of affiliates to join the Hive ransomware operation. Hive, which was eventually disrupted by international law enforcement, was responsible for compromising more than 1,500 victims globally between June 2021 and January 2023. Stryzhak is specifically linked to attacks against at least seven organizations, including healthcare providers, dental practices, and various legal firms.
Impact and Ongoing Law Enforcement Efforts
The scale of the damage caused by the groups Stryzhak supported has been substantial. According to FBI operations director Brett Leatherman, the ransomware operations in which Stryzhak participated were instrumental in the disruption of patient care at medical facilities and contributed to total losses exceeding $100 million. In many instances, victims were forced to pay ransoms to receive decryption keys, a process that frequently failed to guarantee the full recovery of encrypted data or the prevention of data exfiltration.
While the sentencing of Stryzhak marks a significant victory for federal prosecutors, the investigation remains active. The U.S. State Department continues to pursue the leadership behind these operations, offering a reward of up to $10 million for information leading to the arrest or conviction of Volodymyr Tymoshchuk, who remains at large. Additional rewards of up to $1 million are available for information concerning other key figures in the criminal hierarchy that orchestrated these campaigns.
This case underscores the persistent challenge posed by the affiliate model in the modern ransomware landscape, where individual actors can move fluidly between different malware-as-a-service (MaaS) operations to maximize their reach and financial gain. For security professionals, the conviction serves as a reminder of the importance of robust incident response, comprehensive data backups, and proactive threat intelligence in mitigating the risks posed by these highly organized cybercrime syndicates.
