Hive and Nefilim ransomware affiliate sentenced to 70 months

A Ukrainian national, Artem Aleksandrovych Stryzhak, was sentenced in a Brooklyn federal court to 70 months in prison for involvement in Hive and Nefilim ransomware operations that extorted millions from victims. The U.S. Attorney’s Office for the Eastern District of New York said Stryzhak pled guilty in December 2025 to conspiracy to commit fraud, extortion and related computer activity, and the court’s DoJ press release confirms the 70-month term.

The case notes an ongoing reward of up to $11 million for information leading to the arrest or location of his co-conspirator, Volodymyr Tymoshchuk, who remains at large.

Court documents and the DoJ briefing describe how Stryzhak conducted illicit activity across both Hive and Nefilim, encrypting networks worldwide and threatening to publish stolen data on public leak sites if victims did not pay. Nefilim’s operators allegedly granted him access to the ransomware code in mid-2021 in exchange for a share of proceeds, while he also operated as an early Hive affiliate, targeting roughly 1,500 victims including government entities, hospitals and private sector organisations.

The attacks reportedly disrupted operations and, in some cases, forced facilities to suspend digital services. The FBI and Spanish law enforcement assisted in the case, with U.S. authorities emphasising the harm caused by such ransomware campaigns and the consequences for victims’ operations. Tymoshchuk remains sought by authorities under a rewards programme.