VULNpocalypse
InformationalBreach / campaignMonitoring

Ransomware affiliate Artem Stryzhak gets 70 months for Nefilim and Hive attacks

Ukrainian Nefilim and Hive affiliate Artem Stryzhak was sentenced to 70 months in a US court, while alleged Nefilim boss Volodymyr Tymoshchuk remains at large.

Published
Updated
Exploitation
Yes, court documents describe ransomware attacks on hospitals, law firms and businesses by Nefilim and Hive affiliates, and Hive infrastructure was seized in January 2023

What happened

Ukrainian national Artem Stryzhak was sentenced to 70 months in prison by a New York federal court for his role as an affiliate of the Nefilim and Hive ransomware gangs, according to The Register. The HIPAA Journal reports the sentencing took place in federal court in Brooklyn on October 27, 2026.

Nefilim. Prosecutors believe Stryzhak began working with Nefilim around June 2021 while living in Barcelona, Spain, per The Register. Court documents say he agreed with alleged Nefilim boss Volodymyr Tymoshchuk to pay the crew 20 percent of the ransom proceeds he collected. Tymoshchuk steered affiliates toward companies in the US, Canada and Australia with more than $100 million in annual turnover, later raised to more than $200 million, per the same report. The Cyber Express says he stayed involved until at least October 2021 and cites a June 2021 data theft from an oil and gas transportation company. The HIPAA Journal says he used Nefilim ransomware against entities in the United States between June 2021 and October 2021.

Hive. Stryzhak also joined Hive as “one of its earliest affiliates” and used it against approximately seven victims, per The Register. The Cyber Express lists those victims as law firms, a dental office and a healthcare provider during the pandemic. Hive’s operators claimed about 1,500 victims worldwide between June 2021 and January 2023. Separate court documents cited by The Register say an Ohio hospital paid about $1.7 million in Bitcoin after an initial $2 million demand. Hive’s infrastructure was seized in an international law enforcement operation in January 2023.

Impact and timeline. The FBI’s Brett Leatherman said the groups Stryzhak took part in were responsible for more than $100 million in victim damages, per The Register. Spanish police arrested Stryzhak in June 2024, and he was extradited to the US in April 2025. The HIPAA Journal gives the extradition date as April 30, 2025. The Cyber Express says he pleaded guilty in December 2025 to two counts of conspiracy involving fraud, extortion and related activity connected to computers. As part of the FBI’s earlier Hive disruption campaign, investigators obtained a decryption key and gave it to one of his victims, who recovered data without paying.

Still at large. Tymoshchuk remains at large. The Justice Department reminded the public that rewards totaling up to $11 million are available for qualifying information about him and other key ransomware suspects, per The Register. The Cyber Express attributes the reward to the State Department’s Transnational Organized Crime Rewards Program.

Reported details differ slightly. Stryzhak’s age is given as 36 by The Cyber Express and 35 by The HIPAA Journal, so his exact age is not confirmed.

Am I affected?

The sources describe no vulnerability, affected software version or ongoing campaign tied to this sentencing. No CVEs are cited.

  • Organizations named as victims in the sources include an Ohio hospital, law firms, a dental office, a healthcare provider and an oil and gas transportation company. Whether any other organization was affected is not confirmed in the sources.
  • Nefilim guidance to affiliates favored companies in the US, Canada and Australia with annual revenue above $100 million, later above $200 million, per The Register. Hive was known for attacking healthcare facilities.
  • Whether other Nefilim or Hive affiliates remain active is not confirmed. The FBI says it will keep pursuing Stryzhak’s co-conspirators, including Tymoshchuk.

What to do now

  1. Treat the sentencing as a reminder, not an incident. No emergency patching or indicator-based response is supported by these sources.
  2. Review your ransomware readiness: tested offline or immutable backups, a rehearsed restore process, and a documented extortion response plan. These are general good practice, not steps from the sources.
  3. If you are in healthcare, legal or a large business in the regions named above, brief leadership on the pattern the sources describe: affiliates paying a revenue share to a core crew, with targets chosen by ability to pay.
  4. If you have been a victim of Nefilim or Hive, or hold information on Volodymyr Viktorovych Tymoshchuk, contact the FBI. The Cyber Express gives the number +1-917-242-1407, though the published text is truncated, so verify current contact details with the FBI.
  5. Ask law enforcement whether a decryption key is available if you hold files encrypted by Hive. The FBI obtained a key and gave it to one of Stryzhak’s victims. Whether keys exist for other victims is not confirmed.
  6. Watch for follow-up reporting on Tymoshchuk and the remaining co-conspirators.

Sources