Ukrainian Ransomware Affiliate Sentenced in New York

Federal Court Hands Down Prison Sentence

A federal court in New York sentenced 36-year-old Ukrainian national Artem Aleksandrovych Stryzhak to 70 months in prison on October 27, 2026, for his operational role in the Nefilim and Hive ransomware syndicates. Court documents released by the US Department of Justice and the FBI confirm the sentence concludes a multi-year cross-border investigation. Spanish law enforcement originally arrested Stryzhak in Barcelona during June 2024 before extraditing him to United States custody in April 2025. He pleaded guilty to two counts of conspiracy to commit computer fraud in December 2025.

This marked the second major cross-border extradition finalized by federal prosecutors this month. Three days ago on October 25, 2026, authorities extradited a Chinese national linked to a $36.9M cryptocurrency fraud scheme targeting 174 individual victims. Federal agencies tracked illicit capital flows across multiple blockchain networks to establish concrete evidentiary trails for both dockets. Global regulatory bodies continue closing jurisdictional gaps through aggressive cross-border extraditions and compliance mandates. The prison term was locked in.

Extortion Schemes Targeted Healthcare Providers

Prosecutors established that Stryzhak operated as an early affiliate for Nefilim starting in June 2021, remitting a 20% cut of extortion proceeds to group administrators. Syndicate operators instructed affiliates to pursue high-net-worth targets capable of servicing massive payout demands. Court records show Stryzhak transitioned into the Hive ransomware operation, hitting at least seven victims that included law firms and medical providers. Federal investigators noted those specific intrusions disrupted hospital patient care during the COVID-19 pandemic.

Combined losses across both syndicates exceeded $100M according to forensic accounting exhibits filed by the US Department of Justice. Victims paid ransom demands in privacy coins and major digital assets before blockchain analytics firms untangled the transaction graphs. Defense counsel argued for leniency based on limited administrative access, but federal judges rejected the mitigation arguments. The financial damage proved extensive.

Co Conspirator Remains At Large

Law enforcement pursuit of the broader network continues following the sentencing phase in New York. Court records identify Volodymyr Tymoshchuk as a primary co-conspirator who has evaded capture across multiple European jurisdictions. Federal agencies maintain an active $11M bounty for intelligence leading directly to the arrest of Tymoshchuk. The manhunt persists.

Intelligence sharing between Interpol and domestic cyber units uncovered encrypted messaging backups used by the affiliate network. Investigators analyzed over 4 TB of seized server logs to map out cryptocurrency mixing addresses utilized during the payout cycles. Financial intelligence units flagged suspicious wallet activity moving through decentralized liquidity pools last quarter. The investigation remains open.