Nefilim and Hive Ransomware Affiliate Sentenced to 70 Months in Prison

Cybercriminal Sentenced for Global Ransomware Attacks

A Ukrainian national has been sentenced to 70 months in prison for his involvement in Nefilim and Hive ransomware campaigns. According to court documents and law enforcement announcements, the attacks targeted hospitals, government institutions, and high-revenue corporations across the globe between 2018 and 2021.

The sentencing follows the extradition of 35-year-old Artem Aleksandrovych Stryzhak to the United States on April 30, 2025. Authorities had previously arrested him in Spain in June 2024.

Operations as a Nefilim and Hive Affiliate

Court records indicate that starting in June 2021, Stryzhak operated as a Nefilim affiliate, paying 20% of collected ransom payments in exchange for custom malware and decryption keys. His targets included major corporations in the United States, Canada, and Australia.

To pressure victims into complying, the ransomware operations routinely threatened to publish stolen sensitive data on dark web leak sites unless ransoms were paid. Officials noted that these operations caused significant financial damage and disrupted critical services, including patient care during the COVID-19 pandemic.

Stryzhak also joined the Hive ransomware operation as an early affiliate, where court documents show he compromised and encrypted systems belonging to seven victims, including healthcare providers and legal firms.

Guilty Plea and Legal Consequences

In December 2025, Stryzhak entered a guilty plea to computer fraud conspiracy charges. Prosecutors stated that his actions impacted organizations in multiple countries, including the United States, Norway, France, Switzerland, Germany, and the Netherlands.

Law enforcement agencies continue to pursue other individuals linked to these cybercrime networks. Notably, the U.S. State Department maintains a reward offer of up to $11 million for information leading to the arrest of Volodymyr Tymoshchuk, an alleged accomplice who remains at large.

How to Verify and Protect Against Ransomware

Organizations seeking to verify official legal developments regarding international cybercrime cases can consult press releases from the U.S. Department of Justice (DOJ) or updates provided by the Federal Bureau of Investigation (FBI).

• Implement Strong Access Controls: Use multi-factor authentication (MFA) across all enterprise networks.
• Maintain Offline Backups: Regularly test data backups to ensure rapid recovery without paying ransoms.
• Monitor Network Traffic: Deploy Endpoint Detection and Response (EDR) solutions to identify unauthorized intrusions early.