Ukrainian Nefilim and Hive Affiliate Artem Stryzhak Jailed for 70 Months - Hackread

Artem Stryzhak, 36, formerly of Barcelona, was arrested in Spain in June 2024 and extradited to the United States in April 2025. The US Department of Justice announced his 70-month prison sentence on October 27, following his guilty plea in December to two computer-crime conspiracy counts.

Paying for Access to Nefilim

Stryzhak joined Nefilim as an affiliate around June 2021, agreeing to give its administrators 20% of his ransom proceeds in exchange for access to the malware. The operation provided affiliates tools to research companies before attacking them, examining victims' revenue, size and contact information using public databases.

They prepared separate ransomware executables, decryption keys and ransom notes for each victim. The extortion continued after encryption, with threats to publish stolen information on Nefilim's "Corporate Leaks" websites if companies refused to pay.

Hive Attacks Included Healthcare Victims

Stryzhak also became one of Hive's earliest affiliates, deploying its ransomware against seven victims including law firms, a dental office and a healthcare provider. During the investigation, the FBI supplied one of those victims with a decryption key, allowing it to recover encrypted files without paying.

Authorities said Hive ransomware collectively attacked approximately 1,500 victims between June 2021 and January 2023. Investigators are still seeking Stryzhak's charged co-conspirator, Volodymyr Tymoshchuk, whom prosecutors identify as a Nefilim administrator. The State Department is offering up to $11 million for information leading to his arrest or conviction.