A 35-year-old Ukrainian national who rented ransomware infrastructure and turned it on hospitals, law firms, and a dental practice will spend just under six years in federal prison. Artem Aleksandrovych Stryzhak was sentenced in Brooklyn on October 27 to 70 months, closing a case that began with his arrest in Spain in June 2024 and extradition the following April.
Prosecutors described a two-track criminal career. Prosecutors say he signed on with Nefilim as an affiliate in June 2021, handing the crew a fifth of whatever he brought in so he could use their encryptor and back-end. Over the following four months he ran Nefilim against multiple U.S. targets. He then moved to Hive, where between June 2021 and January 2023 he and co-conspirators deployed the ransomware against seven victims, including a healthcare provider operating during the COVID-19 pandemic.
That period was Hive’s most aggressive. The group would go on to hit more than 1,500 organizations globally and extracted roughly $100M in payments before an FBI infiltration in January 2023 handed victims decryption keys.
He admitted conspiring to commit fraud and related offences tied to international ransomware work, an offence carrying a statutory ceiling of ten years. His co-defendant, Volodymyr Tymoshchuk, was indicted but has not been caught. The State Department is offering $11M for information leading to his arrest.
For hospital security leaders, the sentencing is a reminder that affiliate arrests rarely unwind an intrusion. The clinical disruption lands first and the prosecution arrives years later, if at all.
