A Ukrainian ransomware affiliate who lived in Barcelona has been sentenced to 70 months in a US prison for conspiracy to commit computer fraud. The case connects attacks on healthcare, legal services and energy transport with a criminal business model in which attackers shared ransom proceeds with malware administrators.
Artem Aleksandrovych Stryzhak, 36, was arrested in Spain in June 2024, extradited to the United States in April 2025 and pleaded guilty in December 2025, according to reporting by SecurityWeek. His prosecution shows the reach of cross-border enforcement, but also the distinction between bringing an individual attacker to justice and pursuing the people running the wider operation.
What happened
Court documents described Stryzhak’s involvement with two ransomware groups, Nefilim and Hive. He became a Nefilim affiliate in June 2021 and carried out attacks using its malware against organisations in the United States and other countries. The documented period of his Nefilim activity ran until October that year.
Under an agreement with Nefilim administrator Volodymyr Tymoshchuk, Stryzhak was to pass 20 per cent of the ransom money obtained from victims to the operation’s administrators. That arrangement gave the administrators a financial stake in attacks conducted by an affiliate rather than requiring them to carry out every intrusion themselves.
An unnamed business transporting oil and gas was among Stryzhak’s Nefilim victims. SecurityWeek’s account does not identify the company, describe the duration of any disruption or establish whether operational systems were affected. Its inclusion nevertheless places an organisation serving the energy sector within the scope of the case, alongside victims in professional services and healthcare.
Evidence presented in court also identified Stryzhak as an early Hive affiliate. He used that group’s ransomware against seven organisations, including a dental practice, a healthcare provider and law firms. Some victims paid demands and received a key intended to decrypt their files.
The provision of those keys does not establish how quickly the organisations recovered or whether all affected services were restored. The reported evidence describes the payment-and-decryption exchange, rather than a complete account of the victims’ operational recovery. That distinction matters when assessing the consequences of an attack beyond the ransom itself.
The background
Hive’s wider activity extended far beyond the seven organisations linked to Stryzhak. The group attacked more than 1,500 victims worldwide between June 2021 and January 2023, according to the court material reported by SecurityWeek. That total concerns the group as a whole and should not be attributed to this defendant.
The affiliate structure is a well-established feature of ransomware operations: administrators supply malicious software, while other participants deploy it and share the proceeds. Stryzhak’s involvement with both Nefilim and Hive illustrates why a ransomware group’s name does not necessarily identify a fixed set of attackers. Individual participants can work with more than one operation.
For UK and European organisations, that overlap limits the value of organising resilience plans around individual criminal brands. The relevant exposure is the ability of attackers to deny access to systems and information, whether the malware comes from one group or another. The source does not identify any British victims or specify which countries outside the United States were affected by Stryzhak’s attacks.
The pursuit of Nefilim’s leadership remains separate from Stryzhak’s sentence. Tymoshchuk is still at large, with the US State Department offering up to $10 million for information leading to his arrest or conviction. A further reward of up to $1 million covers information about other leaders of the ransomware groups he ran.
What people are saying
FBI operations director Brett Leatherman put the harm to essential services at the centre of the bureau’s response. In a statement reported by SecurityWeek, he said: “These groups disrupted patient care and caused more than $100 million in losses.”
That figure describes the groups’ wider impact. It should not be read as a calculation of losses attributable solely to Stryzhak, or as the amount he personally received. The report does not give a breakdown of the losses or specify how much consisted of ransom payments rather than other costs.
The reference to interrupted care gives the case a significance beyond financial extortion. In healthcare, unavailable information can affect clinical decisions and the ability to deliver treatment. Leatherman’s statement does not identify the affected hospitals or describe particular patient outcomes, so it cannot support more specific claims about clinical harm.
SecurityWeek’s account contains no response from Stryzhak or his legal representatives, and no direct testimony from the victim organisations. The public account therefore offers an enforcement perspective rather than a detailed picture of how affected staff and service users experienced the attacks.
What happens next
Several questions about the sentence remain unanswered in the published report. It does not specify restitution, any arrangements for returning recovered money to victims, or whether an appeal is planned. A prison term is not, by itself, evidence that victims will recover their financial losses.
For investigators and affected organisations, further disclosures could clarify how the intrusions began. The account identifies no initial access method, exploited vulnerability or compromised supplier. There is consequently no basis for linking these attacks to a particular software flaw or prescribing a case-specific technical fix.
For UK and European continuity teams, the practical issue is how to sustain critical work when trusted systems become unavailable. Exercises can test who authorises alternative working arrangements, which services take priority and how staff obtain essential information without relying on the affected network. These are resilience implications of the reported harm, not findings about weaknesses at the named categories of victim.
Recovery planning also needs a security threshold, not simply an availability target. Restoring files does not necessarily remove an attacker’s access; incident responders must establish whether systems are safe to reconnect. Separately protected backups, rehearsed restoration procedures and clear responsibility for those decisions remain relevant regardless of the outcome of a criminal prosecution.
Further court material or victim disclosures would be needed to establish the full operational cost of this case. Until then, organisations assessing it should keep the confirmed criminal conduct, the FBI’s group-wide assessment and the unanswered questions about individual victims distinct.
