Summary
Artem Stryzhak, a 36-year-old Ukrainian national, has been sentenced to 70 months in prison for his role in the Nefilim and Hive ransomware operations. He pleaded guilty in December 2025 to two counts of conspiracy to commit fraud, extortion, and related activity in connection with computers.
Background
- Stryzhak was an affiliate of the Nefilim ransomware group while living in Barcelona, Spain. In 2021 he used Nefilim to attack organizations in the United States, Canada, and Australia, paying the administrators a 20% fee on ransoms.
- He later worked with the Hive ransomware gang from October 2021 to January 2023. Hive targeted hospitals, government entities, and businesses and reportedly encrypted thousands of victims across 80 countries.
- Prosecutors cited one hospital that could not accept new patients during the pandemic because of a Hive attack. An FBI official said the groups caused more than $100 million in losses.
- Spanish authorities arrested him in June 2024, and he was extradited to the U.S. the following April.
Still at Large
Co-conspirator Volodymyr Tymoshchuk, an alleged administrator of the Nefilim, LockerGoga, and MegaCortex groups, remains at large. The U.S. Department of Justice has offered an $11 million reward for information leading to him.
Takeaways
- Ransomware affiliates are being identified, arrested abroad, and extradited years after their attacks.
- Healthcare remained a consistent target, with direct patient-care impact.
- Defenders should keep offline, tested backups and monitor for affiliate tradecraft such as data exfiltration ahead of encryption.