Five Years for $100 Million in Chaos: The Ransomware Affiliate Who Attacked Hospitals During a Pandemic Finally Gets His Sentence

Illustrative editorial image of a server rack and abstract encrypted data in a newsroom-style setting

Desk: Crime, Law & Justice, Public Safety & Policing / Courts & Litigation / National Security & Defense
Byline: Dakota Jones

A note on the headline: “Chaos” here means havoc, not the name of a ransomware group. The U.S. Department of Justice identifies Nefilim and Hive in this case. A small distinction, perhaps, unless you are trying to report the facts accurately.

The lead: Artem Stryzhak, a 36-year-old Ukrainian national formerly of Barcelona, Spain, has been sentenced to 70 months in prison for his role in ransomware conspiracies that caused more than $100 million in losses. That is five years and ten months. The headline’s “five years” is doing some rounding; the court’s sentence is doing the counting.

What happened: one sentence, two ransomware groups

According to the DOJ, Stryzhak joined the Nefilim ransomware conspiracy as an affiliate around June 2021. An affiliate is an operator who uses a ransomware group’s tools to attack victims, while sharing some of the proceeds with the people who supply access. In this arrangement, Stryzhak agreed to pay Nefilim administrators, including co-conspirator Volodymyr Tymoshchuk, 20% of ransom proceeds in exchange for access to the ransomware.

One documented Nefilim attack took place in June 2021. Stryzhak stole data from an oil-and-gas transportation company, then created email addresses that appeared in the ransom note sent to the company. He was involved with Nefilim until at least October 2021.

He was also one of the earliest affiliates of the Hive ransomware group. Hive attacked approximately 1,500 victims worldwide, including hospitals, government entities and businesses. The Record reports that the group encrypted thousands of victims across 80 countries. Among the organizations attacked by Stryzhak and his co-conspirators were seven victims, including law firms, a dentist office and a healthcare provider.

The timing matters. Hive attacks disrupted responses to the COVID-19 pandemic. In one case, a hospital had to forgo digital technology to treat existing patients and could not immediately accept new patients after the attack. There is no clever way to dress that up. When a cyberattack interferes with patient care, the harm is not abstract.

Illustrative editorial image of an empty hospital admissions area with a monitor showing a generic error screen

Why the affiliate model matters

The 20% arrangement is a compact example of ransomware as a service: one set of actors provides the ransomware, while affiliates carry out attacks and share proceeds. It is a business model built to divide the work, and, investigators say, to cause real damage at scale.

The organizations in this case included businesses in the United States and other countries. The Record reports attacks on organizations in the United States, Canada and Australia. The victims were not all alike. They included healthcare providers, law firms and public entities. The common denominator was the disruption and the demand for ransom.

There was, however, a point where the attack chain was interrupted. During a months-long FBI campaign to disrupt Hive, the bureau provided a decryption key to one of Stryzhak’s victims. That victim was able to recover its data without paying a ransom. A rare piece of good news in a story that has very little room for it.

Illustrative image of anonymous analysts reviewing abstract network and file-recovery visuals

The arrest, plea and sentence

Stryzhak was arrested in Spain in June 2024 and extradited to the United States in April 2025. In December 2025, he pleaded guilty to two counts of conspiracy to commit fraud, extortion and related activity in connection with computers. The DOJ announced the 70-month sentence on October 27, 2026.

The investigation involved the FBI’s Springfield Field Office for the Nefilim case and its Tampa Field Office for Hive. The DOJ’s Office of International Affairs, FBI New York and Spanish law enforcement assisted with locating, arresting and extraditing Stryzhak. Prosecutors came from the Eastern District of New York’s National Security and Cybercrime Section and the Middle District of Florida, with the DOJ’s Computer Crime and Intellectual Property Section also involved.

Assistant Attorney General A. Tysen Duva put the message plainly: “Cybercriminals who terrorize American businesses cannot evade justice by operating from abroad or hiding behind sophisticated technology.”

That is the promise of a cross-border investigation. It is also why the sentence deserves accurate context: an arrest, extradition, guilty plea and prison term followed years of investigative and legal work.

One co-conspirator remains at large

The case is not a full stop. Tymoshchuk, whom the DOJ describes as a ransomware developer and Stryzhak’s co-conspirator, remains at large. The State Department’s Transnational Organized Crime Rewards Program offers up to $11 million for information leading to his arrest, conviction or location. The Record also reports a separate $15 million reward for information about other Hive members.

U.S. Attorney Joseph Nocella Jr. said authorities “remain determined to capture Volodymyr Tymoshchuk.” The reward is not a conviction, and a public offer is not a substitute for evidence. It is a clear signal that investigators are still seeking him.

Illustrative editorial image of a generic justice document and secure server equipment

What the record tells us

The DOJ says that since 2020, its Computer Crime and Intellectual Property Section has secured convictions of over 180 cyber and intellectual-property criminals and court orders for the return of over $350 million in victim funds. Those are cumulative figures from the department, not amounts tied to Stryzhak’s case.

For you, the central takeaway is straightforward: ransomware is not just a technical incident. The attacks described here affected hospitals, businesses and government entities, and one hospital’s ability to treat and admit patients. The public deserves reporting that distinguishes what the court established, what investigators allege about other suspects, and what remains unresolved.

That standard is central to LD3 Productions’ trust-first approach to journalism. We cover consequential cases with clarity, and make our reporting accessible across multiple platforms. No fog machine required.

FAQ

How long is 70 months?
Five years and ten months.

Which ransomware groups were involved?
Nefilim and Hive, according to the DOJ. “Chaos” in the headline is a description of the damage, not a group name in this case.

Did a victim pay after the FBI intervened?
The DOJ says the FBI provided one of Stryzhak’s victims with a decryption key, allowing it to recover data without paying a ransom.

Has Volodymyr Tymoshchuk been captured?
No. The DOJ says he remains at large. The State Department is offering up to $11 million for information leading to his arrest, conviction or location.

Final Thoughts

Seventy months is a substantial sentence. It does not undo the disruption or restore the time and resources victims spent responding. But the case shows that operating across borders did not prevent investigators from pursuing Stryzhak through arrest, extradition, prosecution and sentencing.

The verdict is clear: ransomware affiliates can be held accountable, and the work continues when co-conspirators remain at large. Keep the facts distinct, the victims in view and the reporting grounded. That is how justice coverage earns trust.

Sources