ما الذي حدث
Artem Aleksandrovych Stryzhak, a 35‑year‑old Ukrainian, was sentenced to 70 months in U.S. federal prison for acting as an affiliate of the Nefilim and Hive ransomware groups. From 2018‑2021 he financed and helped operate ransomware campaigns that encrypted and exfiltrated data from hospitals, government agencies, and large corporations across the United States, Canada, Australia, Norway, France, Switzerland, Germany, and the Netherlands. He received 20 % of ransom payments for access to custom Nefilim ransomware and decryption keys, and also participated in Hive attacks that affected a dentist office, law firms, and a healthcare provider during the COVID‑19 pandemic. The operation threatened to publish stolen data on dark‑web “Corporate Leaks” sites unless victims paid. The case was built on a guilty plea in December 2025, court documents, and coordinated arrests by U.S., Spanish, and international law‑enforcement agencies.
لماذا يهم ذلك للثقة والامتثال
- The breach demonstrates why organizations must maintain incident‑response controls that generate defensible, audit‑ready evidence of detection, containment, and recovery from ransomware events.
- Map ransomware‑related incident‑response controls to your framework of record to prove readiness.
- Collect and retain forensic logs as continuous evidence for audit and regulatory review.
Who is affected
Healthcare providers Government agencies Large enterprises
Recommended actions
- Validate your incident‑response plan against ransomware scenarios and ensure it aligns with control objectives.
- Test backup restoration processes and verify that logs are stored in a tamper‑evident repository.