Serial ransomware crook gets 70 months behind bars for Nefilim, Hive roles

Artem Stryzhak, a Ukrainian ransomware criminal, has been sentenced to 70 months in prison by a federal court in New York for his involvement with the Nefilim and Hive ransomware groups. Prosecutors believe Stryzhak started working with Nefilim around June 2021 while living in Barcelona, Spain. Nefilim, a ransomware-as-a-service (RaaS) operation, targeted wealthy companies and encouraged affiliates to demand high ransom payments.

Nefilim's most notable attack was on the Australian logistics company Toll Group in 2020. Stryzhak was part of the group and agreed to give 20% of the ransom proceeds he collected to the crew. Nefilim's leader, Volodymyr Tymoshchuk, remains at large. Stryzhak also joined Hive, one of the earliest affiliates, and used its platform to attack around seven victims.

Hive targeted about 1,500 victims worldwide between June 2021 and January 2023. Hive's operators claimed they targeted entities in regions with annual revenues of over $100 million, later adjusted to $200 million. Hive's victims included a law firm and an Ohio hospital, which paid $1.7 million in Bitcoin after initially being demanded for $2 million during the COVID-19 pandemic.

Stryzhak was arrested by Spanish police in June 2024 and extradited to the US in April 2025. The FBI's assistant director for the cyber branch, Brett Leatherman, described Stryzhak as a "prolific cybercriminal" responsible for more than $100 million in damages. Leatherman emphasized the seriousness of Stryzhak's crimes and the FBI's ongoing efforts to hold his co-conspirators accountable, including Tymoshchuk.

The Justice Department also announced rewards totaling up to $11 million for information about Tymoshchuk and other key ransomware suspects.