Nefilim and Hive Affiliate Artem Stryzhak Sentenced to 70 Months
Summary
Artem Stryzhak was sentenced to 70 months after pleading guilty to cybercrimes involving ransomware attacks on businesses and critical infrastructure. Authorities say he worked with Nefilim and Hive affiliates; an alleged co-conspirator remains wanted.
Key points
- Stryzhak pleaded guilty to multiple cybercrimes in late 2025 and was sentenced to 70 months in prison.
- Authorities say his attacks from 2018 to 2021 affected hospitals, government entities, businesses and law firms; hospital attacks disrupted patient care.
- Prosecutors said he was an early Hive affiliate and participated with co-conspirators in deploying Hive against seven victims during the COVID-19 pandemic.
- Officials said Nefilim affiliates customized ransomware files for victims and threatened to publish stolen data to extort them.
- Stryzhak was arrested in Spain in June 2024 and extradited to the United States in April 2025.
- Authorities are seeking alleged co-conspirator Volodymyr Tymoshchuk and previously announced an $11 million reward for information leading to his arrest or conviction.
Article Details
- Event Type
- Artem Aleksandrovych Stryzhak was sentenced to 70 months in prison after pleading guilty to multiple cybercrimes involving ransomware attacks.
- Impact
- The attacks targeted hospitals, government entities, and businesses across multiple countries. Hospital attacks disrupted patient care; Nefilim attacks caused millions of dollars in extortion payments and network damage, and the group threatened to publish stolen data.
MITRE ATT&CK
People
Threat Actors
Artem Aleksandrovych StryzhakPleaded guilty to multiple cybercrimes and was sentenced for participating in ransomware attacks. Authorities said he joined Nefilim and Hive and was one of the earliest Hive affiliates.HiveRansomware group that authorities said Stryzhak joined; he was described as one of its earliest affiliates and deployed its ransomware against seven victims with co-conspirators.NefilimRansomware group associated with attacks that extorted victims, threatened to publish stolen data, and caused millions of dollars in losses.Volodymyr TymoshchukIdentified by authorities as Stryzhak’s alleged co-conspirator; authorities are seeking information leading to his arrest or conviction.
Malware
Countries
AustraliaThe ransomware group primarily targeted companies located in the United States, Canada and Australia with more than $100 million in annual revenue, and extorted victims by threatening to publish stolen data.CanadaThe ransomware group primarily targeted companies located in the United States, Canada and Australia with more than $100 million in annual revenue, and extorted victims by threatening to publish stolen data.FranceStryzhak’s victims in the United States include an engineering consulting company based in France, an aviation industry company in New York, a chemical company in Ohio, an insurance company in Illinois, a company in theGermanyStryzhak and his co-conspirators also used Nefilim ransomware to encrypt victim networks in Germany, the Netherlands, Norway and Switzerland, prosecutors said.NetherlandsStryzhak and his co-conspirators also used Nefilim ransomware to encrypt victim networks in Germany, the Netherlands, Norway and Switzerland, prosecutors said.NorwayStryzhak and his co-conspirators also used Nefilim ransomware to encrypt victim networks in Germany, the Netherlands, Norway and Switzerland, prosecutors said.SwitzerlandStryzhak and his co-conspirators also used Nefilim ransomware to encrypt victim networks in Germany, the Netherlands, Norway and Switzerland, prosecutors said.United Statesfrom accessing data, and putting sensitive information in the hands of bad actors,” Joseph Nocella Jr., U.S.
Industries
AviationStryzhak’s victims in the United States include an engineering consulting company based in France, an aviation industry company in New York, a chemical company in Ohio, an insurance company in Illinois, a company in theConstructioncompany in New York, a chemical company in Ohio, an insurance company in Illinois, a company in the construction industry in Texas, a pet care company in Missouri and an international eyewear company.Engineering consultingStryzhak’s victims in the United States include an engineering consulting company based in France, an aviation industry company in New York, a chemical company in Ohio, an insurance company in Illinois, a company in theGovernmentArtem Aleksandrovych Stryzhak was involved in ransomware attacks on hospitals that disrupted patient care, government entities, a dentist office, a company in the oil and gas transportation industry and law firms.Insurancecompany based in France, an aviation industry company in New York, a chemical company in Ohio, an insurance company in Illinois, a company in the construction industry in Texas, a pet care company in Missouri andOil and gas transportationArtem Aleksandrovych Stryzhak was involved in ransomware attacks on hospitals that disrupted patient care, government entities, a dentist office, a company in the oil and gas transportation industry and law firms.