Ukrainian pleads guilty for role in ransomware attacks targeting U.S., Canadian companies

A man uses a laptop in Toronto in this Sunday, Oct. 9, 2023, photo illustration. THE CANADIAN PRESS/Graeme Roy

A Ukrainian man pleaded guilty in the U.S. last week to one count of conspiracy to commit computer fraud for his role in a series of ransomware attacks that targeted companies in Canada, Australia and the U.S.

Thirty-five-year-old Artem Aleksandrovych Stryzhak, a resident of Spain, conspired with others to deploy ransomware against computer networks in multiple countries starting in 2021, according to the U.S. Department of Justice (DOJ).

“As part of the scheme, the conspirators generated a unique ransomware executable file for each victim, along with a corresponding decryption key and customized ransom note,” the department said in a press release on Friday.

“If a victim paid the ransom demand, the perpetrators provided the decryption key, enabling the victim to decrypt files locked by the ransomware.”

According to court documents referenced by the DOJ, administrators of the ransomware known as “Nefilim” gave Stryzhak access to the ransomware code in 2021 in exchange for 20 per cent of his ransom proceeds.

“Stryzhak operated the ransomware through his account on the online Nefilim platform, known as the ‘panel,’” the release read. “Nefilim administrators preferred to target companies located in the United States, Canada, or Australia with annual revenues exceeding US$100 million.”

In its release, the DOJ did not disclose which companies were targeted or the amount of ransom Stryzhak was able to extract from any of his alleged cyberattacks.

The DOJ said that in the alleged extortion schemes, Stryzhak and his co-conspirators threatened that unless victims agreed to pay a ransom, stolen data would be published on “Corporate Leaks” websites maintained by Nefilim administrators.

Stryzhak was arrested in Spain in June 2024 and extradited to the U.S. in April of this year, according to the DOJ.

In an earlier DOJ press release published immediately after Stryzhak’s extradition, John J. Durham, U.S. Attorney for the Eastern District of New York, said international cyber criminals often operate with the assumption that they are outside the reach of U.S. authorities, but that’s not the case.

Stryzhak is scheduled to be sentenced on May 6, 2026.