Security News: National Security Division Announces First “Near Miss” Non-Prosecution Agreement Under the Department-wide Corporate Enforcement Policy

Source: United States Department of Justice

North Carolina Company Agrees to Pay Criminal Penalties of Over $900,000 Arising out of Unlawful Sales to Russian Weapons Manufacturer Owned by Sanctioned Entity

The Department of Justice announced today that it has entered into a non-prosecution agreement with Extreme Networks, Inc.  The company agreed to pay criminal penalties totaling $975,721.84 to resolve the Department’s investigation of sanctions and export control offenses. 

The Department reached the agreement under its 2026 Corporate Enforcement and Voluntary Self-Disclosure Policy (“the Policy”), which incentivizes companies to voluntarily disclose discovered misconduct, cooperate with Department investigations, and timely and appropriately remediate the wrongdoing.  

This agreement with Extreme Networks marks the Department’s first non-prosecution agreement in a “near-miss” case under the Policy, meaning a case that involved full cooperation and appropriate remediation but did not qualify for a declination of prosecution.  While Extreme Networks’ disclosure to the National Security Division (NSD) was not timely because it occurred under imminent threat of disclosure by a news publication, Extreme Networks nonetheless fully cooperated with the Department’s investigation and timely and appropriately remediated the misconduct. As a result, its disclosure qualified as a “Near Miss” Voluntary Self-Disclosure under the Policy. 

“This non-prosecution agreement and million-dollar criminal penalty mark the successful resolution of our investigation into the illegal sale of advanced networking equipment and services to a Russian weapons manufacturer, in clear violation of U.S. sanctions and export controls,” said Assistant Director Roman Rozhavsky of the FBI’s Counterintelligence and Espionage Division. “The FBI remains dedicated to keeping sensitive technology out of the hands of the Russian military, and we’re grateful to Homeland Security Investigations and the Bureau of Industry and Security for their partnership on this case. Let this announcement serve as a clear warning: if you attempt to arm our adversaries by violating U.S. law, justice will find you.”

“HSI remains committed to investigating companies and individuals who evade U.S. export controls and sanctions to provide goods or services to foreign weapons manufacturers,” said Acting Special Agent in Charge Jeremy Pierczynski of Homeland Security Investigations (HSI) Detroit. “These laws protect our national security and prevent U.S.-origin products and services from supporting adversaries’ military capabilities. HSI will continue working with our law enforcement and regulatory partners to identify and hold accountable those who undermine these critical safeguards.”

The agreement arose out of an investigation into Extreme Networks’ sales of products and services to Moscow Machinery Building Plant Avangard (MMZA), a Russian weapons manufacturer that was owned by JSC Concern Almaz-Antey (Almaz Antey), which was added to the Specially Designated Nationals and Blocked Persons List by the Department of the Treasury’s Office of Foreign Assets Control (OFAC) in July 2014.

Pursuant to the non-prosecution agreement, Extreme Networks will forfeit $487,860.92 in proceeds from the sanctions and export control offenses and pay a criminal fine of $487,860.92, for a total criminal penalty of $975,721.84. Extreme Networks will also resolve a parallel administrative action by OFAC. 

Between around March 2018 and March 2022, Extreme Networks, through its then-Russia based subsidiary, Extreme Networks Rus LLC, processed and fulfilled 11 purchase orders for networking equipment and services to MMZA without the required license or authorization from OFAC. MMZA was a primary producer of the S-300 and S-400 anti-aircraft missile systems used by the Russian army. To facilitate these sales, certain Russia-based Extreme Networks employees concealed the identity of MMZA from Extreme Networks’ global trade compliance group, causing Extreme Networks to file false electronic export information via the Automated Export System and smuggle goods from the United States. Through this scheme, Extreme Networks deprived the U.S. government of its ability to carry out its lawful function of enforcing sanctions and export controls designed to protect national security and economic interests. As a result of its unlawful conduct, Extreme Networks earned approximately $487,860.92 in revenue from the sales of goods and services. 

Although Extreme Networks’ self-disclosure to NSD was not timely pursuant to the Policy, Extreme Networks nonetheless cooperated with the Department’s investigation by timely providing relevant facts and documents and making employees available for interviews. Extreme Networks also appropriately remediated the misconduct by terminating its contract with the third-party distributor it used to facilitate these sales, improving screening procedures, hiring additional compliance personnel, and implementing diligence procedures in connection with mergers and acquisitions. Given these steps and the lack of aggravating circumstances, the Department agreed to enter into a non-prosecution agreement.

The FBI Charlotte Field Office, the Department of Commerce’s Bureau of Industry and Security, and Homeland Security Investigations investigated the case. 

This case was prosecuted by former Trial Attorney Maria Fedor of the National Security Division’s Counterintelligence and Export Control Section and Assistant U.S. Attorney Adam Hulbig for the Eastern District of North Carolina. 

Please see the Justice Department’s policy here.

Florida Inmate Sentenced to Almost Six Additional Years in Prison for Mailing Threatening Communications to a Federal Courthouse

Source: United States Department of Justice Criminal Division

Jacksonville, Florida – Alvin Martin Few (age 62) has been sentenced by U.S. District Judge Wendy W. Berger to five years and eleven months in federal prison for mailing threatening communications. He pleaded guilty on July 14, 2026.  U.S. Attorney Gregory W. Kehoe made the announcement.

Ukrainian National Sentenced to 70 Months in Prison for Multi-Million Dollar Ransomware Conspiracies

Source: United States Department of Justice Criminal Division

BROOKLYN, NY – Earlier today, in federal court in Brooklyn, Artem Stryzhak, a Ukrainian national, was sentenced by United States District Judge Pamela K. Chen to 70 months in prison for using ransomware to extort millions of dollars from victims.  The defendant pled guilty in December 2025 to conspiracy to commit fraud, extortion, and related activity in connection with computers.  

Ukrainian National Sentenced for Role in Hacking Hospitals, Businesses, and Governments as Part of Ransomware Conspiracies Causing Over $100 Million in Losses

Source: United States Department of Justice Criminal Division

Artem Stryzhak, 36, a Ukrainian national, was sentenced today to 70 months in prison for conspiracy to commit computer fraud in connection with a series of ransomware attacks that targeted hospitals, government entities, law firms, and other businesses around the world.

“This sentence concludes a years-long, multi-continent investigation into a defendant who participated in cyber-attacks against Americans’ businesses and health care,” said Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division. “Cybercriminals who terrorize American businesses cannot evade justice by operating from abroad or hiding behind sophisticated technology. Artem Stryzhak’s sentence underscores the Justice Department’s resolve to dismantle ransomware groups, hold them accountable, and protect American businesses and people from cyber extortion.”

“Ransomware attacks like those committed by the defendant wreak enormous havoc — harming victim companies that pay millions in remediation and ransoms, preventing hospitals and other critical facilities from accessing data, and putting sensitive information in the hands of bad actors,” said U.S. Attorney Joseph Nocella Jr. for the Eastern District of New York. “Today’s sentence reflects that cybercriminals cannot hide from law enforcement and will face significant punishment for their criminal conduct. We remain determined to capture Volodymyr Tymoshchuk, a serial ransomware developer and Stryzhak’s co-conspirator.”

“Disrupting a ransomware group that attacked approximately 1,500 victims worldwide and sentencing a defendant who had targeted healthcare during the COVID-19 pandemic is of significant importance to this office,” said U.S. Attorney Gregory W. Kehoe for the Middle District of Florida. “We are proud of our law enforcement partners for their skilled investigative work in bringing this criminal to justice.”

“Artem Stryzhak is a prolific cybercriminal who worked with multiple ransomware groups to target U.S. businesses and hospitals,” said Operations Director Brett Leatherman of the FBI’s Cyber Branch. “These groups disrupted patient care and caused more than $100 million in losses. Today’s sentence reflects the seriousness of Stryzhak’s crimes and demonstrates the FBI’s global reach and extensive network of international partners. Multiple field offices contributed to this investigation, and our work does not end here. We will continue to leverage every tool at our disposal to track down Stryzhak’s co-conspirators and hold them accountable, including Volodymyr Viktorovych Tymoshchuk.”

According to court documents, Stryzhak, formerly of Barcelona, Spain, conspired with others to perpetrate ransomware attacks on behalf of multiple ransomware groups against victim computer networks in the United States and other countries. The conspiracies caused significant damage to victim computer systems. Beginning in approximately June 2021, Stryzhak joined the ongoing Nefilim conspiracy as a Nefilim ransomware affiliate.  Stryzhak was given access to the Nefilim ransomware and agreed with one of the Nefilim ransomware group administrators, Volodymyr Tymoshchuk, to pay the Nefilim administrators, including Tymoshchuk, 20% of the ransom proceeds extorted from victims in exchange for Stryzhak’s access to the Nefilim ransomware. 

The ransomware attacks that Stryzhak conducted with Nefilim ransomware included a June 2021 attack in which Stryzhak stole data from a company in the oil and gas transportation industry. About a week later, Stryzhak created email addresses that were incorporated in a ransom note sent to the victim company. Stryzhak conspired with the Nefilim ransomware actors until at least October 2021. If a victim paid the ransom demand, the perpetrators provided the decryption key, enabling the victim to decrypt files locked by the ransomware.

Also according to court documents, Stryzhak separately joined the Hive ransomware group as one of its earliest affiliates. From June 2021 to January 2023, Hive conspirators attacked approximately 1,500 victims worldwide, including government entities, hospitals, and businesses. Hive ransomware attacks caused major disruptions in victim daily operations around the world and affected responses to the COVID-19 pandemic. In one case, a hospital attacked by the Hive ransomware group had to forgo digital technology to treat existing patients and was unable to accept new patients immediately following the attack. 

In his role as a Hive affiliate, Stryzhak and his co-conspirators deployed Hive ransomware against seven victims, including law firms, a dentist office, and a healthcare provider during the COVID-19 pandemic. Victims were unable to access their encrypted data. The FBI, as part of a months-long disruption campaign against the Hive ransomware group, provided a decryption key to one of Stryzhak’s victims, thereby allowing that victim to decrypt its encrypted data without having to pay a ransom. 

Stryzhak was arrested in Spain in June 2024 and extradited to the United States in April 2025. Stryzhak pleaded guilty in December 2025 to two counts of conspiracy to commit fraud, extortion, and related activity in connection with computers.

The FBI Springfield Field Office investigated the Nefilim ransomware case and the FBI Tampa Field Office investigated the Hive ransomware case. The Criminal Division’s Office of International Affairs, the FBI’s New York Field Office, and Spanish law enforcement authorities provided substantial assistance locating, arresting, and extraditing Stryzhak.

Acting Assistant Deputy Chief James S. Yoon of the Criminal Division’s Computer Crime and Intellectual Property Section (CCIPS), former CCIPS Senior Trial Attorney Brian Z. Mund, and Assistant United States Attorneys Alexander F. Mindlin and Ellen H. Sise of the Eastern District of New York’s National Security and Cybercrime Section prosecuted the Nefilim ransomware case. CCIPS Trial Attorneys Alison M. Zitron and Christen M. Gallagher and Assistant United States Attorney Hannah Watson of the Middle District of Florida prosecuted the Hive ransomware case. 

The U.S. Department of State’s Transnational Organized Crime (TOC) Rewards Program has offered a reward of up to $11 million for information leading to the arrest and/or conviction or location of Stryzhak’s charged co-conspirator, Volodymyr Tymoshchuk. Anyone with information about Tymoshchuk should contact the FBI via phone at +1-917-242-1407, by email at TymoTips@fbi.gov, by contacting your local field office, if in the United States, or by contacting the nearest U.S. Embassy, if located overseas. More information about the Tymoshchuk TOC reward offer and one related to Hive ransomware is located on the State Department website.

CCIPS investigates and prosecutes cybercrime and intellectual property (IP) crime in coordination with domestic and international law enforcement agencies, often with assistance from the private sector. Since 2020, CCIPS has secured the conviction of over 180 cyber and IP criminals, and court orders for the return of over $350 million in victim funds. 

California Man Sentenced for Receiving Child Pornography and Transferring Obscene Material to a Minor

Source: United States Department of Justice Criminal Division

Devin Ravine a/k/a “Derek Johnson,” age 21, of Riverside, California, was sentenced on October 22, 2026 by United States District Judge Anne M. Nardacci to 78 months of imprisonment, followed by 5 years of supervised release, for receiving child pornography and transferring obscene material to a minor.  First Assistant United States Attorney John A. Sarcone III and Craig L. Tremaroli, Special Agent in Charge of the Albany Field Office for the Federal Bureau of Investigation (FBI), made the announcement.

Kansas City Woman Pleads Guilty to Paycheck Protection Plan Fraud

Source: United States Department of Justice Criminal Division

Dezhon Byrd, 33, of Kansas City, Mo., pleaded guilty today to wire fraud in a scheme to fraudulently obtain a Paycheck Protection Plan (PPP) loan totaling $20,832, guaranteed by the U.S. Small Business Administration under the Coronavirus Aid, Relief, and Economic Security (CARES) Act.

UK Citizen and Chairman of Zetland Fiduciary Group Arrested on a Money Laundering Indictment

Source: United States Department of Justice Criminal Division

James Sutherland, 77, a citizen of the United Kingdom, made his initial appearance on an indictment. On June 25, 2026, a federal grand jury in the Eastern District of California returned an indictment charging Sutherland with four counts of money laundering. Sutherland is the Chairman of the Zetland Fiduciary Group, a financial services business, with locations in Hong Kong, Shanghai, Singapore, and Dubai.

Security News: Status of 11 U.S.C. § 330(e) Payments for Fiscal Year 2026

Source: United States Department of Justice

On October 22, 2026, the Department of Justice’s U.S. Trustee Program (USTP) notified the Administrative Office of the U.S. Courts (AOUSC) that trustees will receive additional compensation for cases filed under chapter 7 or converted to chapter 7 in the fiscal year ending September 30, 2026 (FY 2026). These payments are made in accordance with the Bankruptcy Administration Improvement Act of 2020 (BAIA).

View Status of 11 U.S.C. § 330(e) Payments for Fiscal Year 2026

Defense News in Brief: Poland Selected to Host Historic PAC-3 Missile Maintenance Facility, Strengthening Allied Burden-Sharing and Transatlantic Security

Source: United States Department of War

On the margins of the NATO Conference of National Armaments Directors meeting, the United States government, in coordination with Lockheed Martin and European allies, announced Poland as the host nation for the European Patriot Advanced Capability-3 Missile Maintenance Facility.