Ukrainian Ransomware Operator Sentenced to Nearly Six Years as FBI Bounties Reach $11 Million

A federal judge in Brooklyn sentenced Ukrainian national Artem Stryzhak to 70 months in prison, finding him guilty of using ransomware to extort victims on behalf of the Hive and Nefilim criminal networks.

Stryzhak operated as an affiliate, a common role in ransomware-as-a-service schemes where attackers purchase or lease malicious code and then run attacks against targets, pocketing a share of the ransom payments. Prosecutors said he coordinated attacks that forced businesses and public‑sector entities to pay millions of dollars to regain access to encrypted data.

Hive and Nefilim are two of the most prolific ransomware families active in recent years. Hive, first observed in 2021, has targeted hospitals, municipal governments and technology firms, while Nefilim, which surfaced in 2022, is known for rapid encryption and demanding payment in cryptocurrency. Both groups rely on a decentralized affiliate model that makes attribution and disruption difficult for investigators.

The United States Department of Justice highlighted that the case is part of a broader effort to dismantle ransomware operations. In a separate but related action, the FBI announced an $11 million reward for information leading to the arrest of an alleged co‑conspirator believed to have worked closely with Stryzhak.

Law‑enforcement officials say the sizable bounty underscores the priority given to disrupting the financial infrastructure that sustains ransomware campaigns. International cooperation, especially with Ukrainian authorities, has been crucial in tracking down actors who often operate across borders.

Legal experts note that the sentence sends a clear signal to the ransomware ecosystem: affiliates who profit from extortion can face substantial prison terms, even if they are not the original developers of the malware. The conviction may also encourage more victims to cooperate with investigations, knowing that authorities are aggressively pursuing the financial backers of attacks.

Stryzhak is expected to file an appeal, a standard step in federal cases of this nature. Meanwhile, the FBI continues to pursue leads on the broader network, and additional indictments are likely as the agency works to dismantle the affiliate infrastructure that fuels ransomware profits.