DOJ: Ukrainian National Sentenced for Role in Hacking Hospitals, Businesses, and Governments as Part of Ransomware Conspiracies Causing Over $100 Million in Losses

• Stryzhak conspired with Nefilim and Hive ransomware groups, targeting hospitals, governments, and businesses worldwide.
• The U.S. Department of State offers up to $11 million for information on co-conspirator Volodymyr Tymoshchuk.

Artem Stryzhak, a Ukrainian national, was sentenced to 70 months in prison for his role in ransomware conspiracies targeting hospitals, government entities, law firms, and businesses globally. He operated as an affiliate for both Nefilim and Hive ransomware groups, causing significant disruptions and losses, including attacks during the COVID-19 pandemic.

Stryzhak was arrested in Spain in June 2024 and extradited to the United States in April 2025. The FBI and DOJ coordinated a multi-continent investigation, and the U.S. Department of State is offering up to $11 million for information leading to the arrest or conviction of his co-conspirator, Volodymyr Tymoshchuk.

• $100 million losses caused by ransomware attacks
• 1,500 victims attacked by Hive ransomware group
• $11 million reward for information on Volodymyr Tymoshchuk

• Review exposure to Nefilim and Hive ransomware group typologies and affiliate structures as described in DOJ sentencing.
• Update incident response plans for ransomware attacks targeting healthcare and critical infrastructure, referencing the DOJ’s findings on disruptions during the COVID-19 pandemic.
• Monitor the U.S. Department of State’s TOC Rewards Program and FBI advisories for information on Volodymyr Tymoshchuk and related Hive ransomware threats.

This case highlights the persistent threat posed by ransomware groups targeting critical sectors, including healthcare and government, with global reach and significant financial impact. The DOJ’s successful prosecution and ongoing pursuit of co-conspirators demonstrate the importance of international cooperation and robust incident response. Compliance officers must stay vigilant against evolving ransomware typologies, ensure their organizations are prepared for attacks, and monitor law enforcement advisories for emerging threats and reward programs targeting cybercriminals.