A ransomware affiliate who participated in attacks on health-care providers, law firms and other organizations was sentenced October 27, 2026, to 70 months in federal prison, a new outcome in the international investigations of the Hive and Nefilim ransomware networks, marking a significant moment in the ongoing battle against cybercrime and highlighting the seriousness of the ransomware sentence.
Artem Stryzhak, 36, a Ukrainian national formerly living in Barcelona, pleaded guilty in December 2025 to two computer-crime conspiracy counts, according to the Justice Department’s sentencing announcement.
A criminal network, not a single attacker behind every loss
Prosecutors said Stryzhak and co-conspirators deployed Hive ransomware against seven victims, including a dentist’s office, law firms and a health-care provider. The broader Hive operation attacked approximately 1,500 victims worldwide between June 2021 and January 2023.
Those figures describe different things. The network’s global victim count and losses exceeding $100 million should not be presented as a count of attacks personally carried out by Stryzhak. The department said the FBI supplied a decryption key to one of his victims, allowing recovery without paying a ransom.
How the affiliate arrangement worked
The December 19, 2025, guilty-plea announcement describes Nefilim as an operation that supplied ransomware tools to affiliates. In exchange for access, Stryzhak agreed to give administrators 20 percent of his ransom proceeds.
Authorities said the operators researched potential victims’ size and finances. Nefilim favored companies in the United States, Canada and Australia with annual revenue above $100 million. Ransom notes and decryption keys were customized to victims, according to prosecutors.
Stryzhak was arrested in Spain in June 2024 and extradited to the United States in April 2025. That timeline makes this week’s sentence the outcome of a multiyear investigation, not evidence that the underlying attacks occurred this week.
Why a locked computer can become a public-service problem
The federal #StopRansomware Guide explains that ransomware can make essential files and systems unusable. Attackers may also steal data and threaten to release it. A backup can help restore operations, but the threat of exposing stolen information is a separate problem.
That is why ransomware belongs on the public-safety beat as well as the technology page. A disabled system can affect the services people expect to work, not just the employees responsible for maintaining computers. For a medical practice or a municipal office, a response plan has to consider how essential work continues while systems are unavailable.
The earlier Hive disruption
In its January 26, 2023, announcement, the Justice Department said the FBI had infiltrated Hive’s networks beginning in July 2022. Investigators obtained decryption keys and provided them to victims, averting more than $130 million in ransom demands, according to that announcement.
German and Dutch partners assisted in seizing servers and websites used by the operation. The figure for averted demands measures money attackers sought, not a restitution award and not an amount already paid. It also belongs to the broader disruption campaign, rather than this defendant’s individual sentence.
Practical questions for Mohawk Valley organizations
The federal guide recommends keeping offline, encrypted backups and regularly testing whether they can actually be restored. Copies that remain reachable from a compromised network can themselves be encrypted or deleted. Its prevention and response checklists provide a starting point for a discussion with a qualified IT provider.
Useful questions for a business or nonprofit board are straightforward: Who can authorize an emergency response? Where are the recovery instructions if the normal network is unavailable? When was the last successful restore test? Which services must return first? These are planning questions, not a claim that any local organization has been attacked.
Reporting note: The sentence was announced October 27, 2026. Historical group-wide figures are attributed separately from Stryzhak’s conduct. The illustrations are conceptual and do not show an actual victim’s systems.
