A Ukrainian man has been sentenced to nearly six years in a US prison for his role in ransomware conspiracies that targeted organisations across multiple countries, including hospitals, government bodies and businesses.The case involved attacks linked to more than $100 million (£75.2 million) in losses, according to the US Department of Justice, and highlights how ransomware affiliates use malicious software supplied by established criminal networks to target organisations.Artem Stryzhak, 36, received a 70-month prison sentence on 27 October 2026 after pleading guilty to conspiracy charges connected to computer fraud and extortion. Prosecutors said he worked with two ransomware operations, Nefilim and Hive, using malicious software to lock victims out of their data and demand payments.One hospital targeted by the Hive group had to abandon digital technology to treat existing patients and temporarily stop accepting new ones, illustrating how cyberattacks can interfere with healthcare services.How Nefilim Ransomware Helped Attack BusinessesAccording to court documents, Stryzhak joined the Nefilim ransomware operation in June 2021 as an affiliate. He received access to its malicious software through an arrangement with group administrator Volodymyr Tymoshchuk, agreeing to hand over 20% of the ransom proceeds in return.The arrangement followed a ransomware-as-a-service model: administrators supplied the ransomware, while affiliates used it against victims and shared a portion of the proceeds with the operators. This allowed affiliates to use existing ransomware infrastructure rather than develop every part of the operation themselves.One documented Nefilim incident involved a company in the oil and gas transportation industry. In June 2021, Stryzhak stole data from the company and created email addresses used in a ransom note sent about a week later, according to prosecutors.The criminals offered victims decryption keys if they paid the demanded ransom. However, recovering access to encrypted files did not remove the separate risk associated with data already stolen from a compromised network.Hive Ransomware Attacks Disrupted Hospitals During CovidFrom June 2021 to January 2023, Hive attacked approximately 1,500 victims worldwide, including hospitals, government organisations and private businesses. Prosecutors said Stryzhak and his co-conspirators deployed Hive ransomware against seven victims, including law firms, a dental practice and a healthcare provider.The hospital incident described by the Justice Department shows how such attacks can disrupt essential services. Staff had to rely on non-digital methods to care for existing patients, while the facility could not immediately admit new patients after the attack.The FBI had infiltrated Hive’s network by July 2022, months before the Justice Department announced the group’s disruption in January 2023. Investigators obtained decryption keys and helped victims recover files.Officials said the operation helped prevent more than $130 million (£97.7 million) in demanded ransom payments. A decryption key was also supplied to one of Stryzhak’s victims, allowing it to restore encrypted data without paying.Stryzhak was arrested in Spain in June 2024 and extradited to the United States on 30 April 2025. He pleaded guilty in December 2025 to conspiracy charges relating to fraud, extortion and activity involving computers.The sentence followed investigations conducted by FBI field offices in Springfield, Illinois, and Tampa, Florida, with assistance from Spanish authorities and other US agencies.$11 Million Reward Offered for Alleged Ransomware Co-ConspiratorTymoshchuk remains at large, according to US authorities. The State Department’s Transnational Organised Crime Rewards Program is offering up to $11 million (£8.3 million) for information leading to his arrest, conviction or location. He has been charged by US authorities in connection with international ransomware schemes, but the allegations against him have not been established by a conviction in that case.Anyone with relevant information can contact the FBI at +1-917-242-1407 or [email protected]. People in the United States can also contact their local FBI field office, while those overseas can approach the nearest US embassy.The case demonstrates the international reach of ransomware investigations, which can require cooperation between law enforcement agencies in several countries. Stryzhak’s arrest in Spain and subsequent extradition show how authorities can pursue suspects beyond the country where victims are located.For organisations, the incidents underline why ransomware preparation involves more than preventing unauthorised access. Reliable backups, tested recovery procedures and plans for maintaining essential services can help limit disruption when systems become unavailable.The FBI’s Hive operation demonstrated that decryption keys can help victims recover encrypted data without paying a ransom, although they do not necessarily address every consequence of an attack.
Click Here For The Original Source.
——————————————————–
