A 35-year-old Ukrainian citizen, Artem Aleksandrovych Stryzhak, has been extradited from Spain to the United States to face charges related to Nefilim ransomware attacks. Stryzhak was arrested in Spain in June 2024 and extradited on April 30, 2025.
According to the U.S. Department of Justice, Stryzhak allegedly targeted high-revenue companies across multiple countries, including the United States, Norway, France, Switzerland, Germany, and the Netherlands. He reportedly joined the Nefilim ransomware operation in June 2021 as an affiliate, receiving 20% of ransom payments generated from his attacks.
## Attack Methodology
Stryzhak and his co-conspirators methodically researched potential targets using online platforms like Zoominfo to gather information about companies’ revenue, size, and contact details. A Nefilim administrator specifically encouraged Stryzhak to focus on companies with annual revenues exceeding $200 million.
The attack pattern followed a typical ransomware approach:
1. Breach corporate networks
2. Steal sensitive data
3. Encrypt devices using Nefilim ransomware
4. Demand bitcoin ransom payments for decryption keys and to prevent data leaks
5. Publish stolen data online if victims refused to pay
## About Nefilim Ransomware
Nefilim emerged in 2020, sharing code similarities with Nemty ransomware. It encrypted files using AES-128 encryption and added the “.NEFILIM” extension to affected files. The ransomware left ransom notes named “NEFILIM-DECRYPT.txt” throughout infected systems, threatening to leak stolen data within seven days if negotiations weren’t initiated.
Security experts believe Nefilim later rebranded under various names including Fusion, Milihpen, Gangbang, Nemty, and Karma. Notable victims of Nefilim attacks include Toll Group, Orange, and Whirlpool.
Stryzhak faces charges of conspiracy to commit fraud and related activity, including extortion in connection with computers. If convicted, he could face up to five years in prison. His arraignment is scheduled in federal court in Brooklyn before U.S. Magistrate Judge Robert M. Levy.