Nefilim, Hive Ransomware Affiliate Sentenced to 70 Months in Prison
Summary
Artem Stryzhak was sentenced to 70 months in prison after pleading guilty to ransomware-related charges tied to Nefilim and Hive attacks. Authorities said the attacks targeted businesses and healthcare organizations in multiple countries.
Key points
- Stryzhak was sentenced to 70 months in prison following his December 2025 guilty plea to computer fraud conspiracy charges.
- Court documents say he paid 20% of ransom payments for access to custom Nefilim ransomware and decryption keys, and remained a Nefilim affiliate until October 2021.
- Authorities said he joined Hive as an early affiliate and breached and encrypted systems at seven victims, including healthcare and legal organizations.
- The article says Nefilim affiliates threatened to publish stolen data on leak sites to pressure victims into paying.
- Stryzhak was arrested in Spain in June 2024 and extradited to the United States in April 2025.
- Volodymyr Tymoshchuk, described as an alleged accomplice and alleged administrator of several ransomware groups, remains at large; the U.S. State Department offers up to $11 million for information leading to his arrest.
Article Details
- Event Type
- Criminal sentencing of a ransomware affiliate
- Impact
- Artem Aleksandrovych Stryzhak was sentenced to 70 months in prison for his role in Nefilim and Hive ransomware attacks. The attacks targeted hospitals, government entities, and businesses across multiple countries; authorities said the groups disrupted patient care and caused more than $100 million in losses.
People
Brett LeathermanFBI Cyber Branch Operations Director who commented on Stryzhak's crimes, the disruption to patient care, and the reported financial losses.Gregory W. KehoeU.S. Attorney who commented on the importance of disrupting the ransomware group and sentencing a defendant who targeted healthcare during the COVID-19 pandemic.Joseph Nocella Jr.U.S. Attorney who described the reported harms caused by the ransomware attacks, including remediation costs, ransom payments, and disruption to hospitals and other critical facilities.
Threat Actors
Artem Aleksandrovych StryzhakSentenced to 70 months in prison for his role as an affiliate in Nefilim and Hive ransomware attacks. According to court documents, he paid for access to custom Nefilim ransomware and decryption keys; he also admitted to computer fraud conspiracy charges.HiveRansomware group that Stryzhak joined as an early affiliate; he breached and encrypted systems of seven victims, including healthcare and legal organizations.LockerGogaRansomware group for which U.S. authorities charged Volodymyr Tymoshchuk with an administrator role.MegaCortexRansomware group for which U.S. authorities charged Volodymyr Tymoshchuk with an administrator role.NefilimRansomware group whose affiliate Stryzhak targeted large corporations and threatened to leak stolen data unless victims paid.Volodymyr TymoshchukIdentified by U.S. authorities as an alleged accomplice of Stryzhak and charged for alleged administrator roles in ransomware groups. The article says he remains at large.
Malware
Countries
AustraliaWhile active as a Nefilim affiliate until October 2021, Stryzhak used the custom-tailored malware to target large corporations in the United States, Canada, and Australia with revenues exceeding $100 million each year.CanadaWhile active as a Nefilim affiliate until October 2021, Stryzhak used the custom-tailored malware to target large corporations in the United States, Canada, and Australia with revenues exceeding $100 million each year.FranceUS prosecutors in connection with ransomware attacks targeting businesses in the United States, Norway, France, Switzerland, Germany, and the Netherlands.Germanywith ransomware attacks targeting businesses in the United States, Norway, France, Switzerland, Germany, and the Netherlands.Netherlandsattacks targeting businesses in the United States, Norway, France, Switzerland, Germany, and the Netherlands.Norwayby US prosecutors in connection with ransomware attacks targeting businesses in the United States, Norway, France, Switzerland, Germany, and the Netherlands.Switzerlandin connection with ransomware attacks targeting businesses in the United States, Norway, France, Switzerland, Germany, and the Netherlands.United StatesThe sentence follows the extradition of 35-year-old Artem Aleksandrovych Stryzhak to the United States on April 30, 2025, after authorities arrested him in Spain in June 2024.
Industries
GovernmentA Ukrainian national was sentenced to 70 months in prison for his role in Nefilim and Hive ransomware attacks targeting hospitals, government entities, and high-revenue businesses worldwide between 2018 and 2021.Healthcareand encrypting the systems of seven victims, including a dentist's office, multiple law firms, and a healthcare provider during the COVID-19 pandemic.