Ukrainian Nefilim and Hive ransomware affiliate Artem Stryzhak sentenced to 70 months in US prison
A US court sentenced Artem Stryzhak, a 36-year-old Ukrainian national, to 70 months in prison for acting as an affiliate of the Nefilim and Hive ransomware operations. The US Department of Justice announced the sentence on October 27. Stryzhak was arrested in Spain in June 2024, extradited to the US in April 2025, and pleaded guilty in December to two computer-crime conspiracy counts. His co-conspirator Volodymyr Tymoshchuk, a Nefilim administrator, remains at large, with the State Department offering up to $11 million for information.
Detalhes técnicos
- Stryzhak joined Nefilim as an affiliate around June 2021, giving administrators 20% of ransom proceeds in exchange for access to the malware; his participation continued until at least October 2021.
- Affiliates researched targets via public databases (revenue, size, contact details) and prepared a separate ransomware executable, decryption key and ransom note per victim.
- Double extortion: stolen data was threatened with publication on Nefilim's "Corporate Leaks" websites.
- In a June 2021 attack he stole data from an oil and gas transportation company and created the email addresses used in the ransom note.
- He was among Hive's earliest affiliates and deployed it against seven victims, including law firms, a dental office and a healthcare provider. The FBI supplied one victim with a decryption key.
- Hive collectively attacked approximately 1,500 victims between June 2021 and January 2023 (a group-wide figure, not Stryzhak's).
Linha do tempo
-
Ukrainian Nefilim and Hive ransomware affiliate Artem Stryzhak sentenced to 70 months in US prison
ler a análise desta fonte ocultar
A US court sentenced Artem Stryzhak, a 36-year-old Ukrainian national, to 70 months in prison for acting as an affiliate of the Nefilim and Hive ransomware operations. The US Department of Justice announced the sentence on October 27. Stryzhak was arrested in Spain in June 2024, extradited to the US in April 2025, and pleaded guilty in December to two computer-crime conspiracy counts. His co-conspirator Volodymyr Tymoshchuk, a Nefilim administrator, remains at large, with the State Department offering up to $11 million for information.
Technical Details
- Stryzhak joined Nefilim as an affiliate around June 2021, giving administrators 20% of ransom proceeds in exchange for access to the malware; his participation continued until at least October 2021.
- Affiliates researched targets via public databases (revenue, size, contact details) and prepared a separate ransomware executable, decryption key and ransom note per victim.
- Double extortion: stolen data was threatened with publication on Nefilim's "Corporate Leaks" websites.
- In a June 2021 attack he stole data from an oil and gas transportation company and created the email addresses used in the ransom note.
- He was among Hive's earliest affiliates and deployed it against seven victims, including law firms, a dental office and a healthcare provider. The FBI supplied one victim with a decryption key.
- Hive collectively attacked approximately 1,500 victims between June 2021 and January 2023 (a group-wide figure, not Stryzhak's).