A Ukrainian ransomware affiliate has been sentenced to 70 months in prison for participating in cyberattacks against hospitals, businesses, law firms and government entities across multiple countries. Artem Stryzhak, 36, was sentenced in the United States for his role in ransomware conspiracies linked to more than $100 million in losses, according to the U.S. Department of Justice (DOJ).
Stryzhak worked with the Nefilim ransomware and Hive ransomware groups, targeting computer network
A Ukrainian ransomware affiliate has been sentenced to 70 months in prison for participating in cyberattacks against hospitals, businesses, law firms and government entities across multiple countries. Artem Stryzhak, 36, was sentenced in the United States for his role in ransomware conspiracies linked to more than $100 million in losses, according to the U.S. Department of Justice (DOJ).
Stryzhak worked with the Nefilim ransomware and Hive ransomware groups, targeting computer networks and disrupting operations across different sectors. The attacks included incidents affecting healthcare providers during the COVID-19 pandemic, when hospitals faced disruptions to their ability to access digital systems and treat patients.
Ukrainian Ransomware Affiliate Linked to Two Groups
According to court documents, Stryzhak joined the Nefilim ransomware operation around June 2021 as an affiliate. He received access to the group's ransomware under an arrangement with administrator Volodymyr Tymoshchuk and agreed to pay the administrators 20% of the ransom proceeds collected from victims.
One documented attack took place in June 2021, when Stryzhak stole data from a company operating in the oil and gas transportation industry. About a week later, he created email addresses that were incorporated into a ransom note sent to the company.
The attackers used ransomware to encrypt victims' files and demanded payment. If a victim paid, the perpetrators provided a decryption key to restore access to the locked data.
Stryzhak remained involved in the Nefilim conspiracy until at least October 2021, court records state.
He separately joined the Hive ransomware group as one of its earliest affiliates. Between June 2021 and January 2023, Hive conspirators attacked approximately 1,500 victims worldwide, including government entities, hospitals and businesses.
The Hive ransomware operation caused significant disruption to organizations, including healthcare facilities responding to the COVID-19 pandemic.
According to the DOJ, one hospital targeted by the group had to stop relying on digital technology to treat existing patients and was temporarily unable to accept new patients immediately following the attack.
As a Hive affiliate, Stryzhak and his co-conspirators deployed ransomware against seven victims. These included law firms, a dental office and a healthcare provider during the pandemic.
The attacks left victims unable to access encrypted data, affecting their day-to-day operations.
The FBI had previously conducted a months-long disruption campaign against Hive. During that effort, investigators obtained a decryption key and provided it to one of Stryzhak's victims, enabling the organization to recover its encrypted data without paying a ransom.
FBI Investigation Spanned Multiple Countries
The investigation involved several FBI field offices and international law enforcement partners.
The FBI Springfield Field Office investigated the Nefilim ransomware case, while the FBI Tampa Field Office investigated the Hive operation. The FBI's New York Field Office, the Justice Department's Office of International Affairs and Spanish law enforcement authorities also assisted in locating, arresting and extraditing Stryzhak.
He was arrested in Spain in June 2024 and extradited to the United States in April 2025. In December 2025, he pleaded guilty to two counts of conspiracy involving fraud, extortion and related activity connected to computers.
The sentence follows a broader effort by U.S. authorities to pursue ransomware affiliates and their associates, including individuals operating outside the country.
$11 Million Reward Offered for Co-Conspirator
Authorities are continuing to seek Volodymyr Viktorovych Tymoshchuk, identified by prosecutors as Stryzhak's co-conspirator and a ransomware developer.
The U.S. Department of State's Transnational Organized Crime Rewards Program is offering up to $11 million for information leading to Tymoshchuk's arrest and/or conviction or location.
Individuals with information can contact the FBI at +1-917-242-1407, email TymoTips@fbi.gov, contact a local FBI field office in the United States or approach the nearest U.S. Embassy overseas.
The DOJ's Computer Crime and Intellectual Property Section, which investigates and prosecutes cybercrime in coordination with domestic and international partners, has secured more than 180 convictions involving cybercrime and intellectual property offenses since 2020. The department also reports obtaining court orders for the return of more than $350 million in victim funds during that period.
Stryzhak's sentence highlights the consequences for individuals who participate in ransomware operations that target critical services and businesses. The investigation into his alleged co-conspirators remains ongoing.
The FBI seizes Virtualine domain in a court-authorized operation alongside the U.S. Department of Justice , disrupting a so-called bulletproof hosting service accused of facilitating cybercrime, the distribution of child sexual abuse material (CSAM), and international money laundering. Before the seizure, Virtualine.net allegedly provided hosting infrastructure to criminal operations and continued supporting certain services despite repeated abuse notifications from law enforcement agencies and
The FBI seizes Virtualine domain in a court-authorized operation alongside the U.S. Department of Justice , disrupting a so-called bulletproof hosting service accused of facilitating cybercrime, the distribution of child sexual abuse material (CSAM), and international money laundering. Before the seizure, Virtualine.net allegedly provided hosting infrastructure to criminal operations and continued supporting certain services despite repeated abuse notifications from law enforcement agencies and other organizations.
The seizure followed a court-authorized operation against Virtualine, which also operated under the names Secury, Massgod, Spamhouse, Lanedo and Omegatech.
According to court records, the service offered hosting, server solutions and domain purchasing options while advertising its ability to protect customers from law enforcement intervention.
FBI Seizes Virtualine Over Alleged Cybercrime Activity
Theophani K. Stamos, First Assistant U.S. Attorney for the Eastern District of Virginia, and Darren B. Cox, Assistant Director in Charge of the FBI Washington Field Office, announced the seizure of Virtualine.net.
Authorities said the domain had been used to facilitate multiple forms of criminal activity, including advertising sexually explicit images of minors, the intentional disclosure of nonconsensual intimate images involving adults and minors, and international money laundering.
Image Source: FBI
Virtualine marketed its services on cybercrime forums, where it openly promoted hosting options for users engaged in illegal activities. In September 2024, the service told a user on Exploit.in that its infrastructure could be used for activities including phishing, carding, email spam and port scanning, while claiming to prohibit child sexual abuse material and terrorism-related content.
However, court records allege that Virtualine knowingly hosted a criminal online forum, identified as Vendor 1, that allowed users to post and sell access to nude, sexually suggestive and sexually explicit images and videos involving minors and adults.
The investigation found that Virtualine continued hosting Vendor 1 despite receiving multiple notifications about sexually explicit images and videos of minors.
According to court records, Virtualine assigned an IP address to Vendor 1 around December 2025, with notifications about the material beginning in January 2026. Reports came from law enforcement agencies in Germany, Canada and Australia, the U.S. National Center for Missing and Exploited Children (NCMEC), and an attorney representing a victim.
Despite these notifications, Virtualine allegedly continued providing hosting services to the forum.
The records also state that Virtualine worked directly with Vendor 1 to develop another website that allowed customers to upload illicit content and download it after making a purchase. Authorities said Virtualine continued hosting this website and had received at least one abuse complaint concerning sexually explicit images of children found on the platform.
Vendor 1 also promoted a hack-for-hire service, through which customers could pay hackers to gain unauthorized access to victims’ online accounts and obtain explicit images and videos.
Virtualine Advertised Measures to Evade Law Enforcement
Beyond its hosting services, Virtualine allegedly offered customers additional protection designed to keep criminal infrastructure operational when authorities intervened.
In March 2026, the provider advertised an “additional protection plan” that it said could be activated after receiving an official request from law enforcement agencies. Under the arrangement, Virtualine would move a customer’s criminal infrastructure to another shell company not affiliated with the provider, after which the server would be reactivated.
The alleged practice illustrates how bulletproof hosting services can be used to maintain online criminal operations by moving infrastructure when enforcement or abuse complaints threaten existing arrangements.
Virtualine also promoted its tolerance of abuse on underground forums. In a June 2025 post on HackForums, it claimed to have ignored more abuse reports than other providers.
Cryptocurrency Payments Linked to Money Laundering
Investigators also examined Virtualine’s payment arrangements and their alleged role in concealing criminal proceeds.
According to court records, Virtualine accepted payments through Bitcoin, including specific unhosted Bitcoin addresses that allowed customers to make direct payments without their funds being flagged as illicit.
The service received payments from criminal customers, some of which investigators could trace directly to various criminal groups. Virtualine then allegedly laundered the funds further to conceal their origin.
Authorities identified international money laundering as one of the criminal activities facilitated through the service.
International Cooperation Behind Virtualine Takedown
The FBI’s Washington Field Office led the investigation, with significant assistance from Germany’s Polizei Hessen, the Netherlands’ Politie Midden-Nederland and the United Kingdom’s National Crime Agency.
Private-sector partners OverRIPE and Lumen also assisted, while the Justice Department’s Office of International Affairs provided additional support.
Assistant U.S. Attorneys Laura D. Withers and Stefanie A. Schwartz are representing the government in the matter.
The seizure of Virtualine.net disrupts a hosting service that authorities allege provided infrastructure and financial services to support criminal activity. The case also highlights the role of international law enforcement cooperation in targeting providers accused of enabling cybercrime across multiple jurisdictions.
Entrar
