Ukrainian Hive and Nefilim Affiliate Gets 70 Months
Artem Stryzhak, 35, sentenced to 70 months for Nefilim and Hive ransomware attacks on hospitals and corporations causing more than $100M in losses.
Morgan "airgap" ReyesSentence confirmed. Artem Aleksandrovych Stryzhak, a 35-year-old Ukrainian national, was sentenced on October 28 to 70 months in US federal prison for operating as an affiliate for both the Nefilim and Hive ransomware groups. Source: BleepingComputer, citing DOJ and FBI official statements.
Background
Stryzhak was arrested in Spain in June 2024. Extradited to the United States on April 30, 2025. He pleaded guilty in December 2025 to computer fraud conspiracy.
Per court documents, he joined the Nefilim operation in June 2021 as an affiliate, taking a 20% cut of ransom payments in exchange for access to custom ransomware and decryption tools. Targets were large corporations in the United States, Canada, and Australia with revenues over $100 million, later pushed to over $200 million at administrator direction. His Nefilim activity ran through October 2021.
He also operated as an early Hive ransomware affiliate, breaching seven victims: a dentist’s office, multiple law firms, and a healthcare provider during the COVID-19 pandemic.
Combined losses attributed to Nefilim and Hive operations exceed $100 million, per FBI Cyber Branch Operations Director Brett Leatherman.
Accomplice still at large
Volodymyr Tymoshchuk, alleged co-administrator for Nefilim and a Stryzhak associate, remains unapprehended. The US State Department offers up to $11 million for information leading to his arrest. Tymoshchuk is on the FBI’s and EU’s most-wanted lists. The DOJ charged him separately in September 2026 for administrator roles in LockerGoga, MegaCortex, and Nefilim operations between July 2020 and October 2021.
Confidence on arrest and sentencing details: confirmed, sourced to official DOJ and FBI statements. Tymoshchuk’s current whereabouts: unconfirmed.
Related coverage
Found this useful? Share it.
