Nefilim and Hive ransomware affiliate sentenced to 70 months in US prison
Ukrainian national Artem Stryzhak was sentenced to 70 months for his role in Nefilim and Hive ransomware attacks between 2018 and 2021, US authorities said.
At a glance
- Artem Aleksandrovych Stryzhak, 35, was sentenced to 70 months in prison, according to the US Justice Department and FBI.
- As a Nefilim affiliate he took 20% of ransoms and targeted large firms in the US, Canada and Australia.
- As an early Hive affiliate he encrypted seven victims, including a dentist's office, law firms and a healthcare provider.
- Officials say the groups caused more than $100 million in losses, with Nefilim alone hitting about 1,500 victims.
Ukrainian national Artem Aleksandrovych Stryzhak, 35, has been sentenced to 70 months in a US prison for his role in the Nefilim and Hive ransomware operations, according to BleepingComputer, citing the US Justice Department and FBI. The attacks took place between 2018 and 2021.
What happened
BleepingComputer reports that court documents describe Stryzhak as a Nefilim affiliate who, starting in June 2021, received 20% of all ransom payments in exchange for access to custom Nefilim ransomware and decryption keys. He remained active as an affiliate until October 2021, targeting large companies in the United States, Canada and Australia. The outlet adds that he was also an early Hive affiliate who breached and encrypted seven victims, including a dentist's office, several law firms and a healthcare provider during the COVID-19 pandemic.
The scale of the damage
According to BleepingComputer, FBI Cyber Branch Operations Director Brett Leatherman said the groups "disrupted patient care and caused more than $100 million in losses." US Attorney Gregory W. Kehoe said the Nefilim operation attacked roughly 1,500 victims worldwide. The case was announced by the Justice Department and FBI, with comments from US Attorneys Kehoe and Joseph Nocella Jr.
How the case unfolded
BleepingComputer lays out the timeline: Stryzhak was arrested in Spain in June 2024, extradited to the United States on April 30, 2025, and pleaded guilty to computer fraud conspiracy in December 2025 before this month's sentencing. The report notes that an alleged accomplice, Volodymyr Tymoshchuk, remains at large, and that the US State Department is offering up to $11 million for information leading to his arrest or conviction.
Why it matters
The sentencing is another example of law enforcement pursuing ransomware affiliates years after the fact, even when operators shut down their brands. Both Nefilim and Hive are defunct as named operations, but the prosecution signals that individuals who profited from the attacks remain exposed to arrest, extradition and prison long after the campaigns end.
Sources
- Nefilim and Hive ransomware affiliate gets 70 months in prison — BleepingComputer
This story is based on the sources listed above. Always check the vendor’s official advisory before acting on critical systems.
