乌克兰籍男子参与勒索软件攻击医院与政府机构被判70个月：相关团伙袭击全球约1500名受害者、损失逾1亿美元
美国司法部10月27日宣布，36岁的乌克兰籍男子 Artem Stryzhak 因参与针对全球医院、政府机构、律师事务所及其他企业的系列勒索软件攻击，被判处70个月联邦监禁，罪名是合谋实施计算机诈骗。司法部称，相关勒索软件团伙给受害者造成的损失超过1亿美元。
根据法庭文件，Stryzhak 此前居住在西班牙巴塞罗那。他于2021年6月加入 Nefilim 勒索软件团伙担任加盟攻击者，从团伙管理者 Volodymyr Tymoshchuk 等人处获得勒索软件使用权，并同意把勒索所得的20%上交团伙。他使用 Nefilim 实施的攻击包括2021年6月窃取一家石油与天然气运输企业的数据，之后一周又创建了用于向该企业发送勒索信的电子邮箱。
文件还显示，Stryzhak 是 Hive 勒索软件团伙最早的加盟者之一。2021年6月至2023年1月间，Hive 共攻击了全球约1,500名受害者，包括政府机构、医院与企业，严重扰乱受害机构的日常运作，并影响了新冠疫情期间的应对工作：曾有一家遭 Hive 攻击的医院被迫放弃使用数字技术诊治现有病人，且在攻击发生后一度无法接收新病人。Stryzhak 本人伙同他人用 Hive 对7名受害者实施攻击，包括律师事务所、一家牙科诊所和一家医疗服务机构，受害者均无法访问被加密的数据。联邦调查局（FBI）在持续数月的 Hive 破坏行动中向他的一名受害者提供了密钥，使其无需支付赎金即解密数据。
Stryzhak 于2024年6月在西班牙被捕，2025年4月被引渡到美国，并于2025年12月就两项与计算机相关的诈骗、勒索合谋罪名认罪。此案的 Nefilim 部分由 FBI 斯普林菲尔德外勤办公室调查，Hive 部分由 FBI 坦帕外勤办公室调查，案件分别由纽约东区联邦检察官办公室与佛罗里达中区联邦检察官办公室联合司法部刑事局团队起诉。
司法部刑事局助理部长 A. Tysen Duva 表示，这项判决为一场历时数年、跨越多个大陆的调查画上句号，并强调在境外作案的网络罪犯无法逃脱美国司法追责。纽约东区联邦检察官 Joseph Nocella Jr. 表示，检方仍在全力缉捕被指为 Nefilim 勒索软件开发者、Stryzhak 的同谋 Tymoshchuk；国务院跨国组织犯罪悬赏计划已为提供其逮捕、定罪或下落线索者开出最高1,100万美元悬赏。
Ukrainian National Sentenced to 70 Months for Ransomware Attacks on Hospitals and Governments Causing Over $100 Million in Losses
The U.S. Department of Justice announced on October 27 that Artem Stryzhak, 36, a Ukrainian national, was sentenced to 70 months in prison for conspiracy to commit computer fraud in connection with a series of ransomware attacks that targeted hospitals, government entities, law firms and other businesses around the world. The Justice Department said the ransomware groups he worked with caused more than $100 million in losses.
According to court documents, Stryzhak, formerly of Barcelona, Spain, joined the Nefilim ransomware conspiracy in June 2021 as an affiliate. He was given access to the Nefilim ransomware and agreed to pay the group's administrators, including Volodymyr Tymoshchuk, 20 percent of the ransom proceeds. His Nefilim attacks included a June 2021 intrusion in which he stole data from a company in the oil and gas transportation industry and, about a week later, created email addresses used in a ransom note sent to that company.
Stryzhak also joined the Hive ransomware group as one of its earliest affiliates. From June 2021 to January 2023, Hive conspirators attacked approximately 1,500 victims worldwide, including government entities, hospitals and businesses, causing major disruptions and affecting responses to the COVID-19 pandemic; in one case, a hospital attacked by Hive had to forgo digital technology to treat existing patients and could not accept new patients immediately after the attack. Stryzhak and his co-conspirators deployed Hive against seven victims, including law firms, a dentist office and a healthcare provider. During a months-long disruption campaign, the FBI provided a decryption key to one of his victims, who recovered their data without paying a ransom.
Stryzhak was arrested in Spain in June 2024 and extradited to the United States in April 2025. He pleaded guilty in December 2025 to two counts of conspiracy to commit fraud, extortion and related activity in connection with computers. The FBI Springfield Field Office investigated the Nefilim case and the FBI Tampa Field Office investigated the Hive case, with prosecutions led by the Eastern District of New York and the Middle District of Florida together with the Justice Department's Criminal Division.
Assistant Attorney General A. Tysen Duva of the Criminal Division said the sentence concludes a years-long, multi-continent investigation and shows that cybercriminals cannot evade justice by operating from abroad. U.S. Attorney Joseph Nocella Jr. said prosecutors remain determined to capture Tymoshchuk, described as a serial ransomware developer and Stryzhak's co-conspirator. The State Department's Transnational Organized Crime Rewards Program has offered up to $11 million for information leading to Tymoshchuk's arrest, conviction or location.
来源：GSM·美国（原文链接）
图片来源：图：位于华盛顿的美国司法部总部大楼。CC BY-SA 3.0，来源：Wikimedia Commons / Photo: U.S. Department of Justice headquarters in Washington, D.C. CC BY-SA 3.0, via Wikimedia Commons.
