Full Report
Federal law enforcement officials accuse Artem Stryzhak, who was arrested in Spain last year, of attacking and extorting multiple companies between 2018 and 2021. The post Ukrainian extradited to US for alleged Nefilim ransomware attack spree appeared first on CyberScoop.
Analysis Summary
Based on the provided text, here is the structured threat actor summary:
# Threat Actor: Nefilim Ransomware Actors (Attribution specific to charged individual)
## Attribution & Identity
**Primary Identified Individual:** Artem Stryzhak (Ukrainian citizen, extradited to the US).
**Known Aliases and Associated Groups:** Affiliated with the **Nefilim** ransomware scheme. Stryzhak acted as an affiliate, using the ransomware in exchange for 20% of extortion proceeds.
## Activity Summary
The group (including Stryzhak and co-conspirators) was active between late 2018 and late 2021, conducting a series of ransomware attacks globally. The activity involved encrypting victim networks, stealing data, and threatening to leak the data online if ransom demands were not met. Stryzhak was arrested in Spain in June 2024.
## Tactics, Techniques & Procedures
- **Encryption:** Used Nefilim ransomware to encrypt computer networks.
- **Data Theft/Exfiltration:** Stole data from victims.
- **Double Extortion:** Threatened to leak stolen data online if victims did not pay.
- **Conspiracy:** Operated as an organized scheme involving administrators and affiliates.
- *No specific MITRE ATT&CK IDs were mentioned in the text.*
## Targeting
**Sectors:** Engineering consulting, aviation industry, chemical industry, insurance, construction, pet care, international eyewear, and oil and gas transportation.
**Geography:** United States, Canada, France, Germany, Australia, the Netherlands, Norway, and Switzerland.
**Victims:** High-revenue companies, generally those with more than $100 million in annual revenue. Specific US victims mentioned include an engineering consulting company (based in France), an aviation company (NY), a chemical company (OH), an insurance company (IL), a construction company (TX), a pet care company (MO), an international eyewear company, and an oil and gas transportation company.
## Tools & Infrastructure
**Malware families used:** Nefilim ransomware.
**Infrastructure (C2, domains, IPs - defang URLs):** None specified in the text (aside from the malware family).
## Implications
The successful extradition of an alleged affiliate demonstrates that international cybercriminals operating abroad are vulnerable to U.S. justice, challenging the common perception that they are unreachable. This indicates continued international cooperation in pursuing cybercrime prosecutions. The primary threat is high-impact extortion campaigns targeting large organizations.
## Mitigations
The article does not explicitly list technical mitigations but implies that defense against known ransomware operations, including data exfiltration prevention and robust offline backups, is necessary. Successful prosecution implies improvements in international law enforcement cooperation.