Serial ransomware crook gets 70 months behind bars for Nefilim, Hive roles

Artem Stryzhak, a Ukrainian cybercriminal, has been sentenced to 70 months in prison by a federal court in New York for his involvement with the Nefilim and Hive ransomware groups. Prosecutors allege Stryzhak began working with Nefilim in June 2021 while residing in Barcelona, Spain. Nefilim, a ransomware-as-a-service (RaaS) operation, targeted wealthy companies and encouraged affiliates to demand high ransom payments.

One of Nefilim's most notable attacks targeted Australian logistics company Toll Group in 2020, encrypting their files around three months after a Mailto ransomware attack. Stryzhak allegedly agreed to pay the ransomware crew a 20 percent cut of the ransom proceeds he collected, with alleged Nefilim leader Volodymyr Tymoshchuk seeking attacks on US, Canadian, and Australian companies with annual revenues over $100 million, later adjusted to $200 million.

Stryzhak also joined Hive, one of the earliest affiliates of the Hive ransomware operation, and used its platform to attack approximately seven victims. Hive targeted around 1,500 victims globally between June 2021 and January 2023, including a law firm and an Ohio hospital that paid $1.7 million in Bitcoin after the gang initially demanded $2 million during the COVID-19 pandemic.

Stryzhak was arrested by Spanish authorities in June 2024 and extradited to the US in April 2025. The FBI's assistant director emphasized the severity of Stryzhak's crimes and the FBI's global reach in pursuing cybercriminals, stating that multiple field offices contributed to the investigation. The Justice Department also reminded the public of available rewards totaling up to $11 million for information leading to the arrest and conviction of key ransomware suspects, including Tymoshchuk.