Hive, Nefilim Ransomware Affiliate Sentenced to 70 Months in Jail

A 36-year-old Ukrainian national who acted as a Nefilim and Hive ransomware affiliate and targeted hospitals and government entities has been sentenced to 70 months in prison. 

Artem Stryzhak was arrested in Spain in June 2024 and extradited to the United States on April 30, 2025. He pleaded guilty in December 2025 for conspiracy to commit fraud, extortion, and related activity in connection with computers.

Stryzhak conspired with other individuals to launch ransomware attacks on behalf of multiple ransomware groups, causing millions of dollars in losses (both from ransomware payments and damage to victim computer systems). Starting in June 2021, he became a Nefilim affiliate and was given access to the Nefilim ransomware. In exchange, Stryzhak would pay the Nefilim group 20 percent of the ransom received from attacks. 

“Artem Stryzhak is a prolific cybercriminal who worked with multiple ransomware groups to target U.S. businesses and hospitals,” said Brett Leatherman, operations director of the FBI’s Cyber Branch, in a release. “These groups disrupted patient care and caused more than $100 million in losses. Today’s sentence reflects the seriousness of Stryzhak’s crimes and demonstrates the FBI’s global reach and extensive network of international partners.” 

“Today’s sentence reflects the seriousness of Stryzhak’s crimes and demonstrates the FBI’s global reach and extensive network of international partners.” 

Stryzhak wasn’t exclusively a Nefilim affiliate. He separately joined the Hive ransomware group as one of its earliest affiliates. Between June 2021 through January 2023, the Hive ransomware appeared across attacks on at least 1,500 victims globally. That included hospitals that were already strained by the Covid-19 pandemic. In one incident, a hospital hit by Hive ransomware wasn’t able to accept new patients due to the disruption from the attack. 

As a Hive affiliate, Stryzhak specifically deployed the Hive ransomware against seven victims, including law firms, a dentist office, and a healthcare provider. 

Both the Nefilim and Hive ransomware families emerged after 2020 (Nefilim was 2020, while Hive was 2021) and operated as ransomware-as-a-service platforms, causing major damages to businesses and pressuring them with double extortion methods. In January 2023, an international law-enforcement operation disrupted Hive’s infrastructure after the FBI secretly infiltrated its network.

While Stryzhak received five years imprisonment, he initially could have faced up to 10 years’ imprisonment before the sentencing occurred.

In his engagements with the Nefilim ransomware group, Stryzhak worked with one of the Nefilim ransomware group administrators, Volodymyr Tymoshchuk. The FBI said that it is seeking further information on Tymoshchuk, and is offering up an award of $10 million for information leading to his arrest or conviction. The FBI is also offering a payment of up to $1 million for information leading to the arrest or conviction of other key leaders of the Nefilim, LockerGoga, and MegaCortex ransomware variants.

“We will continue to leverage every tool at our disposal to track down Stryzhak’s co-conspirators and hold them accountable, including Volodymyr Viktorovych Tymoshchuk,” he said in the statement.