Ransomware Affiliate Sentenced to 70 Months for Nefilim and Hive Roles
Artem Stryzhak receives federal prison sentence for orchestrating high-profile ransomware attacks across multiple international jurisdictions.
1Sentencing of Artem Stryzhak
Artem Stryzhak, a Ukrainian national, received a 70-month prison sentence in a New York federal court. His conviction stems from his active role as an affiliate for both the Nefilim and Hive ransomware gangs. Prosecutors successfully established his involvement in these criminal operations, leading to his eventual extradition from Spain to the United States.
2Nefilim Operational Strategy
Stryzhak began collaborating with the Nefilim ransomware-as-a-service operation around June 2021 while residing in Barcelona. The group specifically targeted wealthy companies capable of paying significant ransoms. Operators like Volodymyr Tymoshchuk instructed affiliates to prioritize businesses in the US, Canada, and Australia with annual revenues exceeding $100 million, later increasing that threshold to $200 million.
3Financial Arrangements and Targets
Court documents reveal that Stryzhak agreed to pay a 20 percent cut of all collected ransom proceeds to the Nefilim leadership. The group gained notoriety for high-profile attacks, including the 2020 encryption of files at the Australian logistics giant Toll Group. These targeted campaigns focused on maximizing financial extraction from large-scale corporate entities globally.
4Hive Ransomware Involvement
Concurrent with his Nefilim activities, Stryzhak joined the Hive ransomware operation as one of its earliest affiliates. He utilized the Hive platform to launch attacks against approximately seven distinct victims. Hive’s broader infrastructure, which targeted roughly 1,500 victims worldwide between June 2021 and January 2023, was eventually dismantled by an international law enforcement operation.
5Impact on Healthcare Sector
Hive’s criminal activities included targeting critical infrastructure, such as a law firm and an Ohio hospital during the COVID-19 pandemic. The hospital paid approximately $1.7 million in Bitcoin after an initial $2 million demand. The group was also identified as a primary actor behind the widespread cyberattacks that severely impacted Costa Rica in 2022.
6FBI Investigation and Reach
FBI Assistant Director Brett Leatherman characterized Stryzhak as a prolific cybercriminal linked to over $100 million in victim damages. The investigation involved multiple FBI field offices and international partners, culminating in Stryzhak's arrest by Spanish police in June 2024. He was subsequently extradited to the United States in April 2025 to face these charges.
7Ongoing Pursuit of Conspirators
Law enforcement efforts remain focused on identifying and capturing Stryzhak’s co-conspirators, specifically the alleged Nefilim operator Volodymyr Tymoshchuk. Tymoshchuk currently remains at large, and the US Justice Department has issued rewards totaling up to $11 million for information leading to the apprehension of him and other key suspects involved in these global ransomware syndicates.
8Significance of the Verdict
This sentencing underscores the effectiveness of international cooperation in combating ransomware-as-a-service models. By dismantling infrastructure and securing convictions against key affiliates, authorities aim to disrupt the financial incentives driving these criminal groups. The case serves as a warning to other cybercriminals that global law enforcement networks are actively tracking their digital footprints.