Ransomware Affiliate Sentenced to 70 Months for Nefilim and Hive Roles
Ukrainian national Artem Stryzhak receives federal prison sentence for orchestrating high-profile ransomware attacks globally.
1Federal Sentencing Outcome
Artem Stryzhak, a Ukrainian national, received a 70-month prison sentence in a New York federal court. He was convicted for his active role as an affiliate within the Nefilim and Hive ransomware-as-a-service operations. This sentencing follows his arrest in Spain in June 2024 and subsequent extradition to the United States in April 2025.
2Nefilim Operational Strategy
Stryzhak began collaborating with the Nefilim group around June 2021 while residing in Barcelona. The operation specifically targeted wealthy companies, with leadership demanding a 20 percent cut of all collected ransom proceeds. Operators prioritized organizations in the US, Canada, and Australia that generated annual revenues exceeding $100 million, later increasing this threshold to $200 million.
3Hive Affiliate Involvement
Concurrent with his Nefilim activities, Stryzhak joined the Hive ransomware operation as an early affiliate. He utilized the Hive platform to execute attacks against approximately seven distinct victims. Hive was notoriously aggressive, claiming to have targeted roughly 1,500 victims globally between June 2021 and January 2023 before its infrastructure was seized by international authorities.
4High-Profile Victim Impacts
The criminal activities of these groups caused significant financial and operational damage to various sectors. Nefilim famously targeted the Australian logistics giant Toll Group in 2020. Meanwhile, Hive compromised critical infrastructure, including a law firm and an Ohio hospital, which paid $1.7 million in Bitcoin after an initial $2 million demand during the pandemic.
5Global Enforcement Efforts
FBI Assistant Director Brett Leatherman characterized Stryzhak as a prolific cybercriminal linked to over $100 million in total victim damages. The investigation involved multiple FBI field offices and international partners, demonstrating a coordinated effort to dismantle RaaS networks. Authorities remain focused on tracking remaining co-conspirators, including the alleged Nefilim leader, Volodymyr Tymoshchuk.
6Targeting Critical Infrastructure
Hive operators gained notoriety for specifically attacking healthcare facilities during the height of the COVID-19 pandemic. Their reach extended to national-level disruptions, such as the 2022 attacks that severely battered Costa Rica. These actions highlight the systemic risks posed by RaaS affiliates who prioritize high-impact targets to maximize their leverage during extortion attempts.
7Ongoing Manhunt Operations
Despite Stryzhak’s sentencing, key figures in these ransomware syndicates remain at large. The US Justice Department continues to offer rewards totaling up to $11 million for actionable information leading to the capture of suspects like Volodymyr Tymoshchuk. This bounty program underscores the persistent challenge of holding decentralized, international cybercriminal leadership accountable for their actions.
8Strategic Security Implications
The prosecution of Stryzhak serves as a critical case study in the efficacy of international extradition and cross-border law enforcement cooperation. By dismantling the affiliate-operator relationship, authorities aim to disrupt the RaaS business model. Organizations must remain vigilant against these evolving threats, as the financial incentives for such criminal syndicates continue to drive sophisticated, large-scale attacks.