Ukraina fuqarosi 2018-yildan 2021-yilgacha butun dunyo bo'ylab shifoxonalar, davlat tashkilotlari va yuqori daromadli bizneslarga qarshi Nefilim va Hive ransomware hujumlaridagi roli uchun 70 oy qamoq jazosiga hukm qilindi.
Jazo 35 yoshli Artem Aleksandrovich Stryjakning 2025-yil 30-aprelda AQShga ekstraditsiya qilinishidan so'ng e'lon qilindi. U 2024-yil iyun oyida Ispaniyada hibsga olingan edi.
"Artem Stryjak AQSh bizneslari va shifoxonalariga hujum qilish uchun bir nechta ransomware guruhlari bilan ishlagan sermahsul kiberjinoyatchi," dedi FBI Kiber bo'limi operatsiyalar direktori Brett Leatherman. "Bu guruhlar bemor parvarishini buzdi va 100 million dollardan ortiq zarar keltirdi. Bugungi jazo Stryjakning jinoyatlarining jiddiyligini aks ettiradi va FBIning global qamrovi hamda keng xalqaro hamkorlar tarmog'ini namoyish etadi."
Sud hujjatlariga ko'ra, u 2021-yil iyun oyidan boshlab maxsus Nefilim ransomware va shifrlash kalitlariga kirish evaziga to'plangan barcha to'lovlarning 20% ini to'lagan.
Stryjak 2021-yil oktyabrigacha Nefilim sherigi sifatida faol bo'lib, AQSh, Kanada va Avstraliyadagi yillik daromadi 100 million dollardan oshgan yirik korporatsiyalarni nishonga olish uchun maxsus moslashtirilgan zararli dasturdan foydalangan. Biroq, Nefilim ma'murlaridan biri keyinchalik uni yillik daromadi 200 million dollardan oshgan yirik kompaniyalarga e'tibor qaratishga undagan.
Jabrlanuvchilarni to'lov qilishga majburlash uchun ransomware operatsiyasi hujumlar paytida o'g'irlangan ma'lumotlarni Nefilim ma'murlari tomonidan boshqariladigan qorong'u veb "Corporate Leaks" saytlarida oshkor qilish bilan tahdid qilgan, agar jabrlanuvchilar to'lov talablarini bajarmasa.
Nefilim to'lov xati (BleepingComputer)
Stryjak shuningdek, Hive ransomware'ning erta sherigi sifatida qo'shilib, COVID-19 pandemiyasi davrida stomatologiya kabineti, bir nechta yuridik firmalar va sog'liqni saqlash provayderini o'z ichiga olgan yetti jabrlanuvchining tizimlarini buzib, shifrlagan.
2025-yil dekabr oyida Stryjak aybini tan oldi va AQSh prokurorlari tomonidan AQSh, Norvegiya, Fransiya, Shveytsariya, Germaniya va Niderlandiyadagi bizneslarga qarshi ransomware hujumlari bilan bog'liq kompyuter firibgarligi fitnasi ayblovlarini tan oldi.
"Dunyo bo'ylab taxminan 1500 jabrlanuvchiga hujum qilgan ransomware guruhini buzish va COVID-19 pandemiyasi davrida sog'liqni saqlashni nishonga olgan ayblanuvchini hukm qilish bu idora uchun muhim ahamiyatga ega," deb qo'shimcha qildi AQSh prokurori Gregory W. Kehoe.
"Ayblanuvchi tomonidan sodir etilgan ransomware hujumlari ulkan vayronagarchilik keltiradi — millionlab dollar to'lov va tiklash xarajatlarini to'laydigan jabrlanuvchi kompaniyalarga zarar yetkazadi, shifoxonalar va boshqa muhim muassasalarning ma'lumotlarga kirishini to'sadi va nozik ma'lumotlarni yomon niyatli shaxslar qo'liga tushiradi," deb ta'kidladi AQSh prokurori Joseph Nocella Jr.
AQSh Davlat departamenti shuningdek, Stryjakning taxmin qilingan sheriklaridan biri, hali ham ozodlikda bo'lgan Ukraina fuqarosi Volodymyr Tymoshchukni hibsga olishga olib kelishi mumkin bo'lgan har qanday ma'lumot uchun 11 million dollargacha mukofot taklif qiladi.
Tymoshchuk Yevropa Ittifoqi va FBIning eng ko'p qidiriladiganlar ro'yxatida turadi va AQSh Adliya vazirligi sentyabr oyida uni LockerGoga, MegaCortex va Nefilim ransomware guruhlari ma'muri sifatidagi rollari uchun ayblagan. U shuningdek, 2020-yil iyulidan 2021-yil oktyabrigacha dunyo bo'ylab yuzlab kompaniyalarga millionlab dollar zarar yetkazgan ransomware hujumlarida ishtirok etgan deb taxmin qilinadi.
Hujumchilar haqiqiy ma'lumotlarga ega bo'lgach, ularning harakatlarining atigi 37% i bloklanadi
Umumiy oldini olish ballari dastlabki kirishdan keyin nima sodir bo'lishini yashirishi mumkin. Hujumchilar haqiqiy ma'lumotlardan foydalangach, oldini olish keskin pasayadi.
Blue Report 2026 mijozlar ishlab chiqarish muhitlarida o'tkazilgan 338 million simulyatsiya bo'yicha texnika-texnika himoyalarni o'lchaydi.
Hisobotni oling
A Ukrainian national was sentenced to 70 months in prison for his role in Nefilim and Hive ransomware attacks targeting hospitals, government entities, and high-revenue businesses worldwide between 2018 and 2021.
The sentence follows the extradition of 35-year-old Artem Aleksandrovych Stryzhak to the United States on April 30, 2025, after authorities arrested him in Spain in June 2024.
"Artem Stryzhak is a prolific cybercriminal who worked with multiple ransomware groups to target U.S. businesses and hospitals," said Brett Leatherman, the FBI's Cyber Branch Operations Director. "These groups disrupted patient care and caused more than $100 million in losses. Today's sentence reflects the seriousness of Stryzhak's crimes and demonstrates the FBI's global reach and extensive network of international partners."
According to court documents, he paid for 20% of all ransom payments collected for access to custom Nefilim ransomware and decryption keys starting in June 2021.
While active as a Nefilim affiliate until October 2021, Stryzhak used the custom-tailored malware to target large corporations in the United States, Canada, and Australia with revenues exceeding $100 million each year. However, one of the Nefilim administrators later encouraged him to focus on large companies that were generating more than $200 million annually.
To pressure victims into paying, the ransomware operation also threatened to leak data stolen during attacks on dark web "Corporate Leaks" websites managed by the Nefilim admins unless victims met the ransom demands.
Nefilim ransom note (BleepingComputer)
Stryzhak also joined Hive ransomware as an early affiliate, breaching and encrypting the systems of seven victims, including a dentist's office, multiple law firms, and a healthcare provider during the COVID-19 pandemic.
In December 2025, Stryzhak pleaded guilty and admitted to computer fraud conspiracy charges brought by US prosecutors in connection with ransomware attacks targeting businesses in the United States, Norway, France, Switzerland, Germany, and the Netherlands.
"Disrupting a ransomware group that attacked approximately 1,500 victims worldwide and sentencing a defendant who had targeted healthcare during the COVID-19 pandemic is of significant importance to this office," added US Attorney Gregory W. Kehoe.
"Ransomware attacks like those committed by the defendant wreak enormous havoc — harming victim companies that pay millions in remediation and ransoms, preventing hospitals and other critical facilities from accessing data, and putting sensitive information in the hands of bad actors," US Attorney Joseph Nocella Jr. noted.
The US State Department also offers up to $11 million for any details that could lead to the arrest of Ukrainian national Volodymyr Tymoshchuk, one of Stryzhak's alleged accomplices, who is still at large.
Tymoshchuk is on the most-wanted lists of the European Union and the FBI, and the US Justice Department charged him in September for his roles as an administrator for the LockerGoga, MegaCortex, and Nefilim ransomware gangs. He was also allegedly involved in ransomware attacks that caused millions of dollars in damages to hundreds of companies around the world between July 2020 and October 2021.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Get the report