Ransomware Affiliate Jailed for 70 Months Over Nefilim and Hive Attacks, Including Toll Group Link

Artem Stryzhak, a Ukrainian national, has been sentenced to 70 months in prison by a New York federal court for acting as an affiliate of the Nefilim and Hive ransomware gangs. Prosecutors say he began working with Nefilim around June 2021 while living in Barcelona, Spain. Under the arrangement, he agreed to pass 20 percent of the ransom money he collected to the group. Its alleged boss, Volodymyr Tymoshchuk, remains at large.

Nefilim operated as ransomware-as-a-service, meaning affiliates carry out attacks using the gang's tools and share the proceeds. Court documents say Tymoshchuk told Stryzhak to focus on companies in the US, Canada and Australia with annual revenue above $100 million, later raised to $200 million. Nefilim's best-known attack was on Australian logistics company Toll Group in 2020, roughly three months after a separate Mailto ransomware incident. Stryzhak also joined Hive as one of its earliest affiliates and used it to attack about seven victims. Hive claimed around 1,500 victims worldwide between June 2021 and January 2023, including a law firm and an Ohio hospital that paid about $1.7 million in Bitcoin.

Hive's infrastructure was seized in an international law enforcement operation in January 2023. The FBI's Brett Leatherman called Stryzhak a "prolific cybercriminal" involved in groups responsible for more than $100 million in victim damages.