Nefilim and Hive Ransomware Affiliate Sentenced to 70 Months in US Prison
Summary
Artem Stryzhak was sentenced to 70 months in US prison after pleading guilty to conspiracy to commit computer fraud. Court documents describe his work as an affiliate for Nefilim and Hive; the State Department is offering rewards for information on group leaders.
Key points
- Stryzhak, a Ukrainian national, pleaded guilty in December 2025 and was sentenced to 70 months in prison for conspiracy to commit computer fraud.
- Court documents say he operated as a Nefilim affiliate from June to October 2021 and agreed to pay the group's administrators 20% of ransom proceeds.
- Documents describe Stryzhak as an early Hive affiliate who used the ransomware against seven victim organizations.
- Some Hive victims paid ransoms, and the cybercriminals provided decryption keys for encrypted files.
- The State Department is offering up to $10 million for information leading to the arrest or conviction of Nefilim administrator Volodymyr Tymoshchuk, who remains at large.
- An FBI official said the ransomware groups disrupted patient care and caused more than $100 million in losses.
Article Details
- Event Type
- Sentencing of a ransomware affiliate
- Impact
- Artem Aleksandrovych Stryzhak was sentenced to 70 months in prison after pleading guilty to conspiracy to commit computer fraud. Court documents state that he used Nefilim ransomware against organizations from June to October 2021 and Hive ransomware against seven victim organizations. FBI operations director Brett Leatherman said the groups disrupted patient care and caused more than $100 million in losses.
MITRE ATT&CK
People
Threat Actors
Artem Aleksandrovych StryzhakCourt documents state that Stryzhak operated as a Nefilim affiliate from June to October 2021 and used Hive ransomware against seven victim organizations. He pleaded guilty to conspiracy to commit computer fraud.HiveRansomware group that court documents say Stryzhak joined as an early affiliate and whose ransomware he used against seven victim organizations.NefilimRansomware operation that Stryzhak joined as an affiliate and used in attacks against organizations in the US and abroad, according to court documents.Volodymyr TymoshchukIdentified in the article as a Nefilim administrator who agreed with Stryzhak to receive 20% of ransom proceeds; he remains at large, according to the article.
Malware
Hive ransomwareDocuments presented in court also show that Stryzhak was one of the early affiliates to join the Hive ransomware group, which hit over 1,500 victims worldwide between June 2021 and January 2023.NefilimA 36-year-old Ukrainian national was sentenced to prison in the US for his role in Nefilim ransomware attacks.
Countries
Industries
DentalThe documents show that Stryzhak used the Hive ransomware against seven victim organizations, including a dental office, a healthcare provider, and law firms.HealthcareThe documents show that Stryzhak used the Hive ransomware against seven victim organizations, including a dental office, a healthcare provider, and law firms.Oil and gas transportationOne of his victims was an unnamed company in the oil and gas transportation industry.