Ransomware Affiliate Behind Hive and Nefilim Attacks Gets 70 Months in Prison

Artem Aleksandrovych Stryzhak, a 36-year-old Ukrainian national, has been sentenced to 70 months in prison for taking part in ransomware attacks between mid-2018 and late 2021, the US Justice Department said. His targets included hospitals where patient care was disrupted, government entities, a dentist office, an oil and gas transportation company and law firms. He joined several ransomware groups, including Nefilim and Hive, which attacked about 1,500 victims worldwide.

Officials said Nefilim attacks caused millions of dollars in losses from extortion payments and network damage. The group allegedly customised the ransomware file for each victim, with unique decryption keys and ransom notes. It mainly targeted companies in the United States, Canada and Australia with more than $100 million in annual revenue, and threatened to publish stolen data. After breaking in, the crew researched victims to learn their net worth, size and contact information.

Stryzhak pleaded guilty in late 2025. He was arrested in Spain in June 2024 and extradited to the United States in April 2025. Authorities are still seeking his alleged co-conspirator, Volodymyr Tymoshchuk, and have announced an $11 million reward for information leading to his arrest or conviction.