Ukrainian Affiliate of Nefilim and Hive Ransomware Gangs Sentenced to 70 Months by US Court

A Ukrainian man who rented ransomware from two criminal gangs and used it against businesses and healthcare organisations has been sentenced to 70 months in a US prison. Artem Aleksandrovych Stryzhak, 35, received the sentence from a federal court in New York for his work as an affiliate of the Nefilim and Hive ransomware operations. The US Justice Department announced the sentencing, and BleepingComputer, The Register and SecurityWeek reported it. The Register's coverage is dated 28 October 2026. Officials used the announcement to renew their hunt for his alleged accomplice, Volodymyr Tymoshchuk, who is still at large.

What happened

The case has moved through several countries and several years. According to the court records and official statements described in the reports, the main events were these:

1. Around June 2021: Prosecutors say Stryzhak began working with Nefilim while he lived in Barcelona, Spain. The Register reports he agreed with Tymoshchuk, whom prosecutors describe as the alleged Nefilim boss, to hand the gang 20 percent of any ransom he collected. In return he received a custom build of Nefilim's ransomware and the decryption keys needed to unlock victims' files.
2. Around the same time: Prosecutors say he also signed up with Hive as one of that operation's earliest affiliates and used its platform against about seven victims.
3. Until October 2021: BleepingComputer reports he stayed active as a Nefilim affiliate until this point.
4. June 2024: Spanish police arrested him.
5. 30 April 2025: He was extradited to the United States.
6. December 2025: According to BleepingComputer, he pleaded guilty to computer fraud conspiracy charges linked to ransomware attacks on businesses in the US, Norway, France, Switzerland, Germany and the Netherlands.
7. Sentencing: A New York federal court sentenced him to 70 months, roughly five years and ten months.

The reports frame the timeline a little differently. BleepingComputer describes the attacks he took part in as running from 2018 to 2021. The Register says prosecutors believe his work with Nefilim began around June 2021. Neither outlet explains the earlier start date.

Brett Leatherman of the FBI called Stryzhak a "prolific cybercriminal." He said the groups Stryzhak worked with caused more than $100 million in losses. The two outlets give Leatherman different titles. BleepingComputer calls him the FBI's Cyber Branch Operations Director, while The Register calls him an assistant director at the bureau's cyber branch. Leatherman added that the FBI would keep pursuing Stryzhak's co-conspirators, and he named Tymoshchuk.

Who is affected

Nefilim and Hive picked their victims in different ways, and the sources describe each in turn.

Nefilim's targets

Nefilim focused on wealthy companies. According to The Register, Tymoshchuk told Stryzhak to go after firms in the United States, Canada and Australia with annual revenue above $100 million. He later raised that bar to $200 million. BleepingComputer attributes the advice to "one of the Nefilim administrators" and does not name Tymoshchuk in that passage. The Register lists Nefilim's 2020 attack on the Australian logistics company Toll Group among the gang's best-known incidents. That attack came about three months after Toll had already been hit by a separate ransomware strain called Mailto. The sources do not say Stryzhak was involved in the Toll attack.

Hive's targets

BleepingComputer reports that Stryzhak's roughly seven Hive victims included a dentist's office, several law firms and a healthcare provider, all attacked during the COVID-19 pandemic. The Register cites separate court documents showing that Hive's victims included a law firm and an Ohio hospital. That hospital paid about $1.7 million in Bitcoin after an initial demand of $2 million. The Register's account does not make clear whether the Ohio hospital was one of Stryzhak's own victims or a victim of Hive more broadly.

Hive itself claimed around 1,500 victims worldwide between June 2021 and January 2023. In January 2023 an international law enforcement operation seized the gang's infrastructure. The Register notes that Hive was also one of the groups that attacked Costa Rica in 2022.

How it works

This case is about a business model, not a software flaw. No CVE or vulnerability is involved. Both gangs ran ransomware-as-a-service (RaaS). In this model a core group builds and maintains the malicious software, then rents it to outside criminals called affiliates. The affiliates break into victim networks, deploy the ransomware to scramble (encrypt) files, and demand payment for the key to unscramble them. The developers take a share of each ransom. In Stryzhak's arrangement with Nefilim, that share was 20 percent.

Nefilim also used a pressure tactic often called double extortion. Before encrypting systems, the attackers copied sensitive data. They then threatened to publish it on dark-web "Corporate Leaks" sites run by Nefilim's administrators unless the victim paid. So even an organisation that could restore its files from backups still faced the risk of a public data leak.

The RaaS model explains why affiliates matter so much to investigators. A single affiliate can work for several brands at the same time, as Stryzhak did with Nefilim and Hive. Taking down one gang's servers does not necessarily stop the people who actually carry out the break-ins.

How serious is it?

The harm described in the case is significant. Officials say the groups Stryzhak worked with caused more than $100 million in losses. They also stress that targets included hospitals and other healthcare providers during the pandemic. US Attorney Gregory W. Kehoe said that disrupting a group with about 1,500 victims, and sentencing someone who attacked healthcare during COVID-19, mattered greatly to his office. US Attorney Joseph Nocella Jr. described the wider damage: remediation and ransom costs, hospitals cut off from their data, and sensitive information falling into criminal hands.

The outlets agree on the core facts: the 70-month sentence, the arrest in Spain, the 2025 extradition and the 20 percent revenue split. They differ on smaller details, including Leatherman's job title, the start date of the attacks, and whether the targeting advice is credited to Tymoshchuk by name.

What to do now

Neither gang's infrastructure is described as active today. Hive's servers were seized in 2023. But the methods these affiliates used are still common. The steps below are standard defensive practice and do not come from the court case.

For IT administrators:

• Keep offline or immutable backups that attackers cannot encrypt or delete, and test restoring from them regularly.
• Require multi-factor authentication on remote access, email and admin accounts.
• Patch internet-facing systems quickly, since they are a common way in for intruders.
• Watch for large or unusual outbound data transfers, which can be a sign of data theft before extortion.
• Prepare and rehearse an incident response plan that includes legal counsel and contacts at law enforcement.
• Pay particular attention if you work in healthcare, legal services or a high-revenue business, since these sectors were named as targets.

For everyday users:

• Be careful with unexpected email attachments and links, especially at work.
• Use unique passwords and turn on multi-factor authentication wherever it is offered.
• Report suspicious messages or odd computer behaviour to your IT team promptly.
• If an organisation tells you your data was exposed, watch your accounts and be alert to follow-up scams.

What we still don't know

• The sources do not name Stryzhak's individual Nefilim victims or say how much he personally collected in ransoms.
• It is unclear whether the Ohio hospital that paid about $1.7 million was among Stryzhak's own Hive victims.
• The reports do not explain why BleepingComputer dates the attacks to 2018 when prosecutors place his Nefilim work from June 2021.
• No details are given on any restitution, forfeiture or other financial penalties.
• Tymoshchuk is still at large. The US State Department offers up to $11 million for information leading to his arrest. The Register describes that figure as the combined total for Tymoshchuk and other key suspects. He was charged in September over alleged roles running LockerGoga, MegaCortex and Nefilim, and he appears on most-wanted lists of the FBI and the European Union.

ITVedas analysis: The case shows that law enforcement can reach affiliates years after the fact and across borders, using a European arrest followed by extradition. With the alleged Nefilim boss still free, though, the sentence mainly removes one operator rather than the ransomware model he worked within.