Ransomware · Threat Intelligence · Incident Response
Ransomware operator jailed for attacks on hospitals and governments
A Ukrainian man has been sentenced to nearly six years in prison after helping the Nefilim and Hive ransomware gangs target hospitals, governments and businesses across 80 countries.
Ross Grant2 min read
The short version
A Ukrainian man has been jailed for almost six years after helping two major ransomware gangs attack hospitals, governments and businesses around the world. The attacks locked up computer systems and sometimes forced hospitals to turn away patients. US authorities say the attacks caused over $100 million in losses. The case shows how law enforcement is working to catch people behind these cyberattacks.
By the numbers
- 70 monthsprison sentence for Artem StryzhakRecorded Future News
- $100 millionlosses caused by attacks, according to the FBIRecorded Future News
- 80countries affected by Hive ransomware attacksRecorded Future News
- thousandsnumber of victims encrypted by HiveRecorded Future News
- $11 millionreward for information on Volodymyr TymoshchukRecorded Future News
- $15 millionreward for information on other Hive membersRecorded Future News
What happened?
A Ukrainian man, Artem Stryzhak, was sentenced to 70 months in prison after pleading guilty to charges related to ransomware attacks. He worked with the Nefilim and Hive ransomware gangs, targeting hospitals, governments and businesses in multiple countries. The attacks caused over $100 million in losses and disrupted patient care, according to US authorities. Stryzhak was arrested in Spain in 2024, extradited to the US, and sentenced after a multi-year investigation.
Who is affected
Artem Stryzhak, a 36-year-old Ukrainian national, was sentenced to 70 months in prison after pleading guilty to charges linked to ransomware attacks. He worked as an affiliate for the Nefilim group and later joined Hive, two ransomware gangs known for targeting hospitals, government agencies and businesses. The attacks hit organisations in the US, Canada and Australia, among others. According to prosecutors, the Hive group alone encrypted thousands of victims in 80 countries during its operations.
How the attack worked
Stryzhak began as an affiliate of Nefilim while living in Barcelona. Affiliates are people who use a ransomware group’s tools to carry out attacks, then pay a share of any ransom to the group’s leaders. Stryzhak paid Nefilim administrators, including Volodymyr Tymoshchuk, a 20% cut of the ransoms he collected. After leaving Nefilim, Stryzhak joined Hive in October 2021 and continued launching ransomware attacks until January 2023. The attacks often disrupted critical services. In one case, a hospital could not accept new patients during the COVID-19 pandemic because its systems were locked by Hive ransomware.
The response
Stryzhak was arrested in Spain in June 2024 and extradited to the US in April 2025. He pleaded guilty in December 2025 to two counts of conspiracy to commit fraud, extortion and related computer crimes. US authorities described him as a prolific cybercriminal whose actions caused more than $100 million in losses and disrupted patient care. The FBI and Department of Justice (DOJ) led a multi-continent investigation to track down Stryzhak and his associates. The Hive gang itself was disrupted by the FBI after a months-long operation. Prosecutors are still searching for Tymoshchuk, who is also accused of being an administrator for other ransomware groups, LockerGoga and MegaCortex. The DOJ has offered an $11 million reward for information on Tymoshchuk and $15 million for information on other Hive members.
What happens next
Stryzhak’s sentencing marks the end of a years-long investigation, but authorities are still pursuing other key figures. US Attorney Joseph Nocella Jr. said the search for Tymoshchuk continues. The case highlights ongoing law enforcement efforts to disrupt ransomware groups and bring their members to justice.
Why it matters
This case shows that ransomware attacks can have serious real-world effects, such as stopping hospitals from treating patients. It also demonstrates that law enforcement agencies are willing to pursue cybercriminals across borders and over several years.
Key points
- A ransomware operator was sentenced to 70 months in prison.
- He helped Nefilim and Hive attack hospitals, governments and businesses.
- The attacks caused over $100 million in losses, according to the FBI.
- Thousands of victims in 80 countries were affected by Hive ransomware.
- Law enforcement continues to pursue other key figures in these gangs.
Sources
Recorded Future News
Reference
