A Ukrainian man who worked with two ransomware gangs, including one that hit an Ohio hospital, got 70 months in prison. Here is what it means for businesses.
A New York federal court has sentenced Artem Stryzhak, a Ukrainian ransomware criminal, to 70 months in prison. That is a little under six years. He worked as a partner for two gangs, Nefilim and Hive. Hive's victims included an Ohio hospital that paid about $1.7 million in Bitcoin to get its systems back.
Ransomware is software that locks a victim's files until they pay. Both gangs ran on a "ransomware-as-a-service" model. The core group builds the tools and rents them to partners, called affiliates, who carry out the attacks. Prosecutors say Stryzhak began working with Nefilim around June 2021 while living in Barcelona, Spain. He agreed to hand the gang 20 percent of the ransom money he collected.
Prosecutors say he also joined Hive around the same time as one of its earliest affiliates. He used its platform to attack about seven victims.
Nefilim pushed its partners to hit companies that could afford large payments. Its alleged boss, Volodymyr Tymoshchuk, told Stryzhak to focus on firms in the US, Canada and Australia with more than $100 million in yearly revenue. That was later raised to $200 million. One of Nefilim's best-known attacks hit Australian logistics company Toll Group in 2020.
Hive claimed about 1,500 victims worldwide between June 2021 and January 2023. Court documents list a law firm and the Ohio hospital among them. The hospital paid during the COVID-19 pandemic after Hive first demanded $2 million. Hive was also one of the groups that hit Costa Rica in 2022.
The FBI's Brett Leatherman called him a "prolific cybercriminal." He said the groups Stryzhak worked with were responsible for more than $100 million in victim damages.
Tymoshchuk, the alleged Nefilim boss, remains at large. The FBI says its work is not finished and that it will keep pursuing Stryzhak's co-conspirators. The Justice Department also noted that rewards of up to $11 million are available for qualifying information about Tymoshchuk and other key ransomware suspects.
This arrest is a win, but it does not remove the threat. These gangs chose targets by their ability to pay. Regular backups and staff training remain the practical defenses for any business that fits that description.
One ransomware partner is going to prison, but the gangs target firms that can pay, so keep backups and train staff.
North Dakota lawmakers are looking at HB 1447, a bill meant to help prevent crypto fraud, and AARP wants residents to speak up.
Read more: North Dakota weighs a bill to curb crypto scamsTuring Award winner Richard Sutton says more computing power alone will not make AI truly smart. Big AI companies disagree, which matters for anyone betting on AI.
Read more: AI pioneer says piling on computing power won't make machines smartA user says Anthropic's Claude Code put his email in web requests, then scam messages arrived. The link is unproven, but it shows what AI tools can share.
Read more: User says Claude Code sent his email address to websites
