Artem Aleksandrovych Stryzhak, age 35, played a major role in multiple attacks against healthcare organizations.

 

What happened

On October 27th, 2026, the United States Attorney’s Office released a statement about Artem Aleksandrovych Stryzhak, a Ukrainian national, who has been sentenced by a United States District Judge to serve 70 months in prison. Stryzhak used ransomware to extort millions of dollars from victims and pleaded guilty in December of 2025 for charges including conspiracy to commit fraud, extortion, and related activity in connection with computers.

US Attorney Gregory Kehoe shared that the groups Stryzkhak worked with, including Nefilim and Hive, have impacted approximately 1,500 victims worldwide, primarily targeting healthcare organizations. The victim count only includes the organizations harmed, not the individuals, which could be well into the millions.

 

Going deeper

According to a prior report from the Attorney’s office, Stryzhak joined Nefilim as an affiliate, meaning he used Nefilim tools to conduct attacks and paid Nefilim administrators 20% of any ransoms he successfully extorted from victims. He worked closely with the administrator of the group, Volodymyr Tymoshchuk, to carry out multiple attacks. Stryzhak continued to work with Nefilim until at least October 2021.

Stryzhak also joined the Hive ransomware group as an early affiliate, working to deploy ransomware against victims between June 2021 and January 2023. Ultimately, the FBI successfully disrupted Hive in 2023 by creating and providing a decryption key to at least one of Stryzhak’s victims, which allowed access to encrypted data without having to pay a ransom. The key was also supplied to numerous other victims, whose attacks may or may not have been conducted in part by Stryzhak.

 

In the know

Back when Hive was a larger presence, Paubox frequently covered the group’s malicious attacks against healthcare organizations, including Ohio’s Memorial Health System, Baton Rouge General, and Georgia organization Tift Regional Health System and Southwell, Inc. Among other financial hardships caused by these breaches, they can also result in large class action lawsuits. Tift, for instance, ultimately paid a $1.2 million settlement.

According to Ransomware Live, Nefilim was not as active against healthcare organizations or in general. The group was last active in 2021 and conducted a total of 15 attacks. It’s unclear why the group dissolved, but it could be that leaders are in hiding or have moved on to work with other groups.

 

What was said

United States Attorney, Joseph Nocella, Jr., made a statement about the harm ransomware attacks can cause, stating that the defendants' actions “wreak enormous havoc – harming victim companies that pay millions in remediation and ransoms, preventing hospitals and other critical facilities from accessing data, and putting sensitive information in the hands of bad actors.”

Nocella added that his office remains “determined to capture Volodymyr Tymoshchuk, a serial ransomware developer and Stryzhak’s co-conspirator.”

 

The big picture

Following sentencing, Stryzhak will likely be taken into custody. His charges and prison time will likely prevent him from continuing any ransomware operations, but his co-conspirator, Volodymyr Tymoshchuk is still at large. An $11 million reward remains available for information that leads to his arrest. Stryzhak, for instance, was arrested in Spain in 2024 and extradited to the United States in the spring of 2025. His arrest and extradition show how cybercriminals operate globally, making them significantly harder to track down and arrest. In the meantime, it’s entirely possible that Tymoshchuk is still conducting attacks with other groups or under other names, but the Justice Department continues to work both nationally and internationally to identify these criminals and hold them accountable.

 

FAQs

Does Nefilim operate as a ransomware-as-a-service gang?

Yes, Nefilim is an example of an organization that provides ransomware to other, smaller actors, in exchange for funds. While we usually don’t know much about the affiliates that pay for these services, Stryzhak is an example of someone who took advantage of a scheme of this type.

 

Why do healthcare organizations pay settlements/face lawsuits if they are also victims?

Healthcare organizations can simultaneously be victims and partially responsible for allowing an attack to happen. Patients place their trust in these organizations to care for their data in any way possible, and many healthcare organizations put cybersecurity on the back burner. They may not conduct audits or risk assessments; they may delay notifications of breaches or fail to take other actions, which ultimately makes data breaches more likely.