Prolific Hive and Nefilim ransomware affiliate sentenced to 70 months in prison

Skip to main content

Get our latest cybersecurity news first on Google.

Click here!

A 36-year-old Ukrainian national was sentenced to 70 months in prison for participating in a string of ransomware attacks targeting various critical infrastructure operators and businesses from the middle of 2018 to late 2021, the Justice Department said Tuesday.

Artem Aleksandrovych Stryzhak was involved in ransomware attacks on hospitals that disrupted patient care, government entities, a dentist office, a company in the oil and gas transportation industry and law firms. He joined various ransomware groups during his crime spree, including Nefilim and Hive, which attacked about 1,500 victims worldwide.

“Ransomware attacks like those committed by the defendant wreak enormous havoc — harming victim companies that pay millions in remediation and ransoms, preventing hospitals and other critical facilities from accessing data, and putting sensitive information in the hands of bad actors,” Joseph Nocella Jr., U.S. attorney for the Eastern District of New York, said in a statement.

Stryzhak pleaded guilty to multiple cybercrimes in late 2025. He was arrested in Spain in June 2024 and extradited to the United States in April 2025. Authorities are still looking for his alleged co-conspirator Volodymyr Tymoshchuk and previously announced a $11 million reward for information leading to his arrest or conviction.

Attacks involving Nefilim ransomware caused millions of dollars in losses from extortion payments and damage to victim networks, officials said. Stryzhak and his co-conspirators allegedly customized executable ransomware files for each victim, creating unique decryption keys and unique ransom notes.

The ransomware group primarily targeted companies located in the United States, Canada and Australia with more than $100 million in annual revenue, and extorted victims by threatening to publish stolen data. The crew researched companies after it broke into their networks to determine their net worth, size and contact information.

Stryzhak’s victims in the United States include an engineering consulting company based in France, an aviation industry company in New York, a chemical company in Ohio, an insurance company in Illinois, a company in the construction industry in Texas, a pet care company in Missouri and an international eyewear company. 

Stryzhak and his co-conspirators also used Nefilim ransomware to encrypt victim networks in Germany, the Netherlands, Norway and Switzerland, prosecutors said. 

Authorities said Stryzhak was one of the earliest Hive affiliates and, with co-conspirators, deployed the ransomware against seven victims during the COVID-19 pandemic.

“This sentence concludes a years-long, multi-continent investigation into a defendant who participated in cyberattacks against Americans’ businesses and health care,” A. Tysen Duva, assistant attorney general of the Justice Department’s Criminal Division, said in a statement. “Cybercriminals who terrorize American businesses cannot evade justice by operating from abroad or hiding behind sophisticated technology.”

Latest Podcasts

Government

• Senators, rights groups say Trump administration breaking law by withholding surveillance court opinion

• CISA publishes strategy with eye on the next four years

• Exclusive: Bipartisan bill would develop federal guidance for distillation attacks, convene industry on defensive cyber

• Philippines-based American pleads guilty to running expansive fraud scheme targeting US servicemembers

Technology

• Senators say targeted ads are a security risk. Ad groups say the critics are off base.

• eMudhra kills its certificate business after researchers cracked its private keys in under a second

• Wyden seeks adoption of encryption tech at hundreds of federal agencies to protect visitors’ sensitive traffic

• DHS to ban DeepSeek from federal civilian agencies

Threats

• Experts temper emergency-level alarms over critical Brotli defect

• Microsoft pins ConnectWise supply-chain attack to China-state aligned threat group

• PHP releases emergency fixes for 2 critical vulnerabilities

• Russian GRU hackers hit NATO shipbuilder, aircraft engine maker, law enforcement agency in espionage campaign

Policy

• DOJ escalates fight for election supremacy with California raids

• Federal agencies recommend cyber controls, independent testing for frontier AI systems

• The next election influence campaign will target your AI chatbot

• Senators press Trump admin to rally federal government around AI safety, security