Ukrainian Nefilim and Hive ransomware affiliate Artem Stryzhak sentenced to 70 months in US prison; Tymoshchuk still at large

Linha do tempo

1. hipaajournal.com ↗ · pub. 29/10/2026 08:44 · coletado 29/10 10:00

   Nefilim and Hive ransomware affiliate Artem Stryzhak sentenced to 70 months in US prison

   ler a análise desta fonte ocultar

   Ukrainian national Artem Aleksandrovych Stryzhak, 35, was sentenced on October 27, 2026 in federal court in Brooklyn to 70 months in prison for his role as an affiliate of the Nefilim and Hive ransomware operations. He was arrested in Spain in June 2024 and extradited to the United States on April 30, 2025, later pleading guilty to conspiracy to commit fraud and extortion in connection with international ransomware operations. Prosecutors said he joined Nefilim in June 2021, paying the operators 20% of ransom proceeds in exchange for access to their infrastructure and encryptor, and used the ransomware against multiple US entities through October 2021. Between June 2021 and January 2023 he also operated as part of Hive, deploying ransomware against seven victims including law firms, a dentist's office and a healthcare provider during the COVID-19 pandemic. Co-conspirator Volodymyr Tymoshchuk was indicted but remains at large, with an $11 million US State Department reward offered for information leading to his arrest.

   Technical Details

   Stryzhak operated under a ransomware-as-a-service model, receiving the Nefilim encryptor and supporting infrastructure in return for a 20% revenue share. Attacks targeted hospitals, government entities and businesses, combining encryption with extortion.

2. securityaffairs.com ↗ · pub. 28/10/2026 17:19 · coletado 28/10 18:00

   Hive and Nefilim ransomware affiliate Artem Stryzhak sentenced to 70 months in US prison; $11M reward for Tymoshchuk

   The article adds details on the Nefilim affiliate model and tooling (customized executables, victim research, "Corporate Leaks" sites), the DoJ attribution of the case to the Eastern District of New York, and the FBI giving a Hive decryption key to one of Stryzhak's victims. It also states the reward for Tymoshchuk as up to $11 million, which differs from the earlier $10M + $1M split.

   ler a análise desta fonte ocultar

   The article adds details on the Nefilim affiliate model and tooling (customized executables, victim research, "Corporate Leaks" sites), the DoJ attribution of the case to the Eastern District of New York, and the FBI giving a Hive decryption key to one of Stryzhak's victims. It also states the reward for Tymoshchuk as up to $11 million, which differs from the earlier $10M + $1M split.

   A federal court in Brooklyn sentenced Artem Stryzhak, a Ukrainian national, to 70 months in prison for using ransomware to extort millions of dollars from victims. He was an affiliate of the Nefilim and Hive ransomware operations. He was arrested in Spain in 2024, extradited to the US in April 2025 and pleaded guilty in December 2025 to conspiracy to commit computer fraud, extortion and related activity. The US State Department is offering up to $11 million for information leading to the arrest, conviction or location of his co-defendant and Nefilim administrator Volodymyr Tymoshchuk, who remains at large.

   Technical Details

   • In June 2021 Nefilim administrators gave Stryzhak access to the ransomware code in exchange for 20% of his ransom proceeds. He deployed it through his account on the administrators' online platform until at least October 2021.
   • Each attack used a customized ransomware executable with unique decryption keys and tailored ransom notes.
   • Stryzhak and his co-conspirators researched victims in online databases (net worth, size, contacts). After gaining network access they stole data and threatened to publish it on the administrators' "Corporate Leaks" sites.
   • In June 2021 he stole data from an oil and gas transportation company and, about a week later, created the email addresses used in the ransom note.
   • He was also one of the earliest Hive affiliates. Hive attacked about 1,500 victims worldwide between June 2021 and January 2023, including government entities, hospitals and businesses.
   • As a Hive affiliate he hit seven victims, including law firms, a dentist's office and a healthcare provider. The FBI, as part of its Hive disruption effort, gave a decryption key to one of his victims, which recovered its data without paying.

   Remediation

   • Anyone with information on Tymoshchuk can contact the FBI at +1-917-242-1407, a local FBI field office, or the nearest US Embassy.
3. bitdefender.com ↗ · pub. 28/10/2026 12:27 · coletado 28/10 14:00

   Ukrainian Hive and Nefilim ransomware affiliate Artem Stryzhak sentenced to 70 months in US prison

   ler a análise desta fonte ocultar

   Artem Stryzhak, a 36-year-old Ukrainian national, was sentenced to 70 months in a US prison for his role in a series of ransomware attacks. He became an affiliate of the Nefilim ransomware group around June 2021 and kept 80% of the ransoms he extorted, with the rest going to Nefilim's administrators. He was also an early affiliate of the Hive ransomware-as-a-service (RaaS) operation. Victims included hospitals, government organisations, law firms, a dentist's office and a healthcare provider. Stryzhak was arrested in Barcelona in June 2024, extradited to the US and pleaded guilty. The article notes that the sentencing came years after the FBI-led infiltration of Hive in 2022.

   Technical Details

   • Nefilim administrators include Volodymyr Tymoshchuk, who was charged last year over attacks on hundreds of victims with LockerGoga, MegaCortex and Nefilim. He is not in US custody, and the US State Department has offered an $11 million bounty for information leading to his arrest.
   • The FBI warned that Hive extorted about US $100 million from organisations worldwide in 18 months. In 2022 the HHS called Hive an "exceptionally aggressive" threat to the health sector.
   • A multinational law enforcement operation secretly penetrated Hive in late July 2022. It captured decryption keys and passed them to victims, which the DOJ said saved victims over US $130 million in ransom payments. This was made public in January 2023.

   Remediation

   The article gives no defensive guidance.

4. theregister.com ↗ · pub. 28/10/2026 12:52 · coletado 28/10 14:00

   Ukrainian Nefilim and Hive ransomware affiliate Artem Stryzhak sentenced to 70 months in US federal court

   ler a análise desta fonte ocultar

   Ukrainian national Artem Stryzhak was sentenced to 70 months in prison by a New York federal court for acting as an affiliate of the Nefilim and Hive ransomware-as-a-service operations. Prosecutors say he joined Nefilim around June 2021 while living in Barcelona, Spain, and also became one of Hive's earliest affiliates, using its platform against roughly seven victims. The FBI says the groups he worked with caused more than $100 million in victim damages. Stryzhak was arrested by Spanish police in June 2024 and extradited to the US in April 2025. The alleged Nefilim boss Volodymyr Tymoshchuk remains at large, and the Justice Department reiterated rewards of up to $11 million for information on him and other key ransomware suspects.

   Technical Details

   • Nefilim targeted wealthy companies. Tymoshchuk steered affiliates toward firms in the US, Canada and Australia with more than $100 million in annual revenue, later raised to more than $200 million. Stryzhak agreed to pay the crew a 20 percent cut of the ransom proceeds he collected.
   • A high-profile Nefilim victim was Australian logistics firm Toll Group in 2020, encrypted about three months after a separate Mailto ransomware attack.
   • Hive operators claimed about 1,500 victims worldwide between June 2021 and January 2023. Victims included a law firm and an Ohio hospital that paid about $1.7 million in Bitcoin after an initial $2 million demand during the COVID-19 pandemic.
   • Hive's infrastructure was seized in an international law enforcement operation in January 2023. The group was also among those that hit Costa Rica in 2022.

   Remediation

   The article gives no defensive guidance. The Justice Department points to rewards of up to $11 million for qualifying information on Tymoshchuk and other key ransomware suspects.

5. securityweek.com ↗ · pub. 28/10/2026 12:05 · coletado 28/10 14:00

   Ukrainian Hive and Nefilim ransomware affiliate Artem Stryzhak sentenced to 70 months in US prison

   ler a análise desta fonte ocultar

   Artem Aleksandrovych Stryzhak, a 36-year-old Ukrainian national, was sentenced in the US to 70 months in prison for conspiracy to commit computer fraud over his role as an affiliate of the Nefilim and Hive ransomware operations. He was arrested in Barcelona, Spain, in June 2024, extradited to the US in April 2025 and pleaded guilty in December 2025. The FBI said the groups he worked with disrupted patient care and caused more than $100 million in losses. The US State Department offers up to $10 million for information leading to the arrest or conviction of Nefilim administrator Volodymyr Tymoshchuk, who remains at large, and up to $1 million for information on other leaders of the groups he ran.

   Technical Details

   • Stryzhak joined Nefilim as an affiliate in June 2021 and was active until October 2021. He agreed to pay Nefilim administrator Tymoshchuk 20% of ransom proceeds.
   • One Nefilim victim was an unnamed company in the oil and gas transportation industry.
   • Court documents show he was also one of the early affiliates of Hive, which hit over 1,500 victims worldwide between June 2021 and January 2023.
   • He used Hive ransomware against seven victim organizations, including a dental office, a healthcare provider and law firms. Some victims paid and received a decryption key.
6. bleepingcomputer.com ↗ · pub. 28/10/2026 06:43 · coletado 28/10 07:00

   Ukrainian Nefilim and Hive ransomware affiliate Artem Stryzhak sentenced to 70 months in US prison

   This article adds details on Stryzhak's affiliate arrangement (20% of ransom payments, June–October 2021, pressure to target companies with revenue above $200 million), the "Corporate Leaks" extortion sites, the FBI's $100 million loss figure, the extradition date (April 30, 2025), the December 2025 guilty plea and the September DOJ charges against Tymoshchuk for LockerGoga, MegaCortex and Nefilim. It also gives his age as 35, where the known report says 36.

   ler a análise desta fonte ocultar

   This article adds details on Stryzhak's affiliate arrangement (20% of ransom payments, June–October 2021, pressure to target companies with revenue above $200 million), the "Corporate Leaks" extortion sites, the FBI's $100 million loss figure, the extradition date (April 30, 2025), the December 2025 guilty plea and the September DOJ charges against Tymoshchuk for LockerGoga, MegaCortex and Nefilim. It also gives his age as 35, where the known report says 36.

   A Ukrainian national, Artem Aleksandrovych Stryzhak, was sentenced to 70 months in prison in the US for his role in Nefilim and Hive ransomware attacks against hospitals, government entities and high-revenue businesses between 2018 and 2021. He was arrested in Spain in June 2024, extradited to the US on April 30, 2025, and pleaded guilty to computer fraud conspiracy in December 2025. The FBI said the groups he worked with caused more than $100 million in losses and disrupted patient care. His alleged accomplice Volodymyr Tymoshchuk remains at large, with a US State Department reward of up to $11 million.

   Technical Details

   • From June 2021 Stryzhak paid 20% of all ransom payments collected in exchange for access to custom Nefilim ransomware and decryption keys. He was active as an affiliate until October 2021.
   • He targeted large companies in the United States, Canada and Australia with annual revenue above $100 million. A Nefilim administrator later encouraged him to focus on companies with more than $200 million in annual revenue.
   • Nefilim used double extortion, threatening to leak stolen data on dark web "Corporate Leaks" sites run by its administrators.
   • Stryzhak was also an early Hive affiliate and breached and encrypted seven victims, including a dentist's office, several law firms and a healthcare provider, during the COVID-19 pandemic.
   • His guilty plea covers attacks on businesses in the United States, Norway, France, Switzerland, Germany and the Netherlands.
   • Prosecutors said the Nefilim operation attacked approximately 1,500 victims worldwide.
   • The US Justice Department charged Tymoshchuk in September as an administrator of the LockerGoga, MegaCortex and Nefilim gangs. He is on the EU and FBI most-wanted lists.
7. cyberscoop.com ↗ · pub. 27/10/2026 15:33 · coletado 27/10 17:00 primeiro registro

   Ukrainian Hive and Nefilim ransomware affiliate Artem Stryzhak sentenced to 70 months in US prison

   ler a análise desta fonte ocultar

   A 36-year-old Ukrainian national, Artem Aleksandrovych Stryzhak, was sentenced to 70 months in prison by a US court (Eastern District of New York), the Justice Department announced. He took part in ransomware attacks from mid-2018 to late 2021 against critical infrastructure operators and businesses, including hospitals, government entities, a dentist office, an oil and gas transportation company and law firms. He worked with several groups, including Nefilim and Hive, which together attacked about 1,500 victims worldwide. Stryzhak was arrested in Spain in June 2024, extradited in April 2025 and pleaded guilty in late 2025. His alleged co-conspirator Volodymyr Tymoshchuk remains at large, with an $11 million reward on offer.

   Technical Details

   • Nefilim operators customized the ransomware executable for each victim, with unique decryption keys and ransom notes.
   • The group mainly targeted companies in the United States, Canada and Australia with more than $100 million in annual revenue.
   • Operators researched victims after intrusion to assess net worth, size and contact information, then extorted them by threatening to publish stolen data (double extortion).
   • Reported Nefilim victims include an engineering consulting company in France, an aviation company in New York, a chemical company in Ohio, an insurance company in Illinois, a construction company in Texas, a pet care company in Missouri and an international eyewear company. Networks in Germany, the Netherlands, Norway and Switzerland were also encrypted.
   • Stryzhak was one of the earliest Hive affiliates and deployed it against seven victims during the COVID-19 pandemic.