A US court has sentenced Ukrainian national Artem Stryzhak to 70 months in prison after he pleaded guilty in a ransomware case involving Nefilim attacks. While the case was reported in the United States, it matters more broadly because it shows that international law enforcement action against ransomware actors is continuing even as ransomware remains a major operational threat for businesses.

What happened

According to the reported court outcome, Stryzhak received a 70-month prison sentence after pleading guilty to using Nefilim ransomware in attacks. The source also links him to Hive and Nefilim ransomware activity.

The sentencing is a confirmed legal development, not a new policy announcement. It does not mean ransomware risk has declined, but it does show that authorities are still pursuing affiliates and other participants involved in ransomware operations.

Why it matters for European businesses

For European companies, the practical message is straightforward: ransomware remains a live business risk, and criminal groups often operate across borders. Even when arrests and prosecutions happen outside Europe, the same tactics, tools and affiliate models can affect organisations in EU markets.

Many ransomware operations do not function like a single centralised gang. They often rely on affiliates, access brokers and supporting infrastructure. That makes the threat persistent even when one actor is arrested or one brand name disappears.

Businesses should also note that enforcement action against attackers does not reduce their own compliance and resilience obligations. Companies still need to protect systems, manage backups, control privileged access and prepare incident-response processes. For some organisations, especially those in regulated or critical sectors, ransomware preparedness also has implications under cybersecurity and data protection rules.

Who may be affected

The case is relevant to a wide range of organisations, but especially to:

• SMEs that may have limited in-house security resources but remain common ransomware targets.
• IT and digital teams responsible for endpoint security, access control, backups and recovery planning.
• E-commerce businesses that depend on website uptime, customer data and payment-related systems.
• Founders and business owners who need to understand ransomware as an operational and financial risk, not just a technical issue.
• Regulated businesses that may face additional reporting, resilience or data protection consequences after a cyber incident.

What companies should consider

This sentencing does not create new obligations for European businesses, but it is a useful prompt to review ransomware readiness. Companies should consider:

• Reviewing backup strategy to ensure backups are isolated, tested and usable in recovery scenarios.
• Strengthening identity security with multi-factor authentication, least-privilege access and tighter controls on administrator accounts.
• Improving detection and response through endpoint monitoring, logging and a clear incident escalation process.
• Checking external exposure such as remote access systems, VPNs, email security and unpatched internet-facing services.
• Testing business continuity plans so leaders know how the company would operate if core systems or websites became unavailable.
• Assessing third-party risk because service providers, hosting partners and software suppliers can also become entry points or disruption factors.

For European business leaders, the broader lesson is that ransomware should be treated as a board-level continuity issue. Criminal prosecutions are important, but they do not replace the need for practical security controls, recovery planning and clear internal accountability.