Artem Stryzhak, 36, a Ukrainian national, received a 70-month ransomware sentence on Oct. 27 for working as an affiliate of the Hive and Nefilim groups, the Justice Department said. The FBI puts losses from the schemes at more than $100 million. The man who helped run the Nefilim side, Volodymyr Tymoshchuk, remains at large, and the State Department offers up to $11 million for information leading to his arrest. Prosecutors have the affiliate, and the administrator has a bounty on his name.
What Stryzhak Pleaded Guilty to
Stryzhak pleaded guilty in December 2025 to two conspiracy counts involving fraud, extortion and related computer activity, and the court sentenced him for conspiracy to commit computer fraud, the Justice Department said. The Eastern District of New York prosecuted the Nefilim case and the Middle District of Florida prosecuted the Hive case. Spanish authorities arrested him in June 2024, and he was extradited to the United States in April 2025.
How the Nefilim and Hive Affiliate Model Worked
Stryzhak joined Nefilim around June 2021 as an affiliate, meaning he rented access to the ransomware and attacked victims himself. In return he paid the administrators, including Tymoshchuk, 20% of ransom proceeds. His Nefilim activity lasted until at least October 2021. In a June 2021 attack on an oil and gas transportation company, he stole data and later created email addresses used in the ransom note.
He was also one of the earliest Hive affiliates. From June 2021 to January 2023, Hive conspirators attacked about 1,500 victims worldwide, including government entities, hospitals and businesses. That is about 79 victims a month across the 19-month window, a calculation from the release’s figures.
The release describes seven Hive victims during the COVID-19 pandemic, among them law firms, a dentist’s office and a healthcare provider. One hospital had to stop using digital systems to treat existing patients and could not immediately accept new ones. During its disruption campaign, the FBI gave one Hive victim a decryption key, and that victim recovered its data without paying.
What Prosecutors and the FBI Said
A. Tysen Duva, the assistant attorney general for the Criminal Division, said in the release that cybercriminals who terrorize American businesses “cannot evade justice by operating from abroad.” Gregory W. Kehoe, the U.S. attorney for the Middle District of Florida, said the case matters given the group’s roughly 1,500 victims and its targeting of healthcare during the pandemic. Brett Leatherman, the operations director of the FBI’s Cyber Branch, called Stryzhak a prolific cybercriminal who worked with several ransomware groups and said the bureau will pursue his co-conspirators.
The timeline shows how long that pursuit takes. Hive’s attack window closed in January 2023, Spain arrested Stryzhak 17 months later and the sentence came 28 months after the arrest, about 45 months from the end of the window, a calculation from the release’s dates. Tymoshchuk is the remaining defendant named in the release, and the State Department’s reward of up to $11 million for information on him stands.
