Ukrainian Ransomware Affiliate Gets 70 Months for Nefilim and Hive Attacks
Seven Lights
A federal court sentenced Artem Aleksandrovych Stryzhak, a 36-year-old Ukrainian national, to 70 months in prison for conspiracy to commit computer fraud connected to his affiliate role in the Nefilim and Hive ransomware operations, SecurityWeek reported.
Stryzhak had been living in Barcelona. Spanish police arrested him in June 2024 and extradited him to the United States in April 2025; he pleaded guilty in December 2025. Court documents show he joined Nefilim as an affiliate in June 2021 and operated with the group until October that year, striking organizations in the United States, Norway, France, Switzerland, Germany and the Netherlands. One victim was an unnamed company in oil and gas transportation.
He agreed with Nefilim’s administrator, Volodymyr Tymoshchuk, to pay the operators 20 percent of the ransom proceeds he collected. Tymoshchuk steered affiliates toward companies in the United States, Canada and Australia with annual revenues above $100 million, later raising the threshold to $200 million, The Register reported. Nefilim’s most publicized strike hit the Australian logistics giant Toll Group in 2020.
Around the same period Stryzhak became one of the earliest affiliates of Hive, breaching and encrypting roughly seven organizations — a dental office, a healthcare provider and law firms — during the COVID-19 pandemic. Some victims paid and received decryption keys. Hive’s operators claimed about 1,500 victims worldwide between June 2021 and January 2023 before law enforcement seized its infrastructure; among its victims was an Ohio hospital that paid some $1.7 million in Bitcoin.
“Artem Stryzhak is a prolific cybercriminal who worked with multiple ransomware groups to target U.S. businesses and hospitals. These groups disrupted patient care and caused more than $100 million in losses,” said Brett Leatherman, assistant director of the FBI’s cyber branch.
The Justice Department used the sentencing to renew rewards totaling up to $11 million for information leading to Tymoshchuk, who remains at large, and other leaders of the groups. The FBI said the investigation into Stryzhak’s co-conspirators continues.