Ukrainian National Pleads Guilty to Conspiracy to Use Nefilim Ransomware to Attack Companies in the United States and Other Countries

A Ukrainian national pleaded guilty today to one count of conspiracy to commit computer fraud for his role in a series of international ransomware attacks.

According to court documents, Artem Aleksandrovych Stryzhak, 35, of Barcelona, Spain, conspired with others to deploy the Nefilim ransomware against victim computer networks in the United States and other countries, causing significant damage to victim computer systems. As part of the scheme, the conspirators generated a unique ransomware executable file for each victim, along with a corresponding decryption key and customized ransom note. If a victim paid the ransom demand, the perpetrators provided the decryption key, enabling the victim to decrypt files locked by the ransomware.

In June 2021, Nefilim administrators gave Stryzhak access to the Nefilim ransomware code in exchange for 20 percent of his ransom proceeds. Stryzhak operated the ransomware through his account on the online Nefilim platform, known as the “panel.” Shortly after gaining access, Stryzhak asked a co‑conspirator whether he should choose a different username than one he used in other criminal activity, in case the panel “gets hacked into by the feds.”

Read more: Department of Justice