Digital Attacks
Ransomware Attack: Hive and Nefilim Affiliate Sentenced in the US to 70 Months in Prison
Ransomware attacks on hospitals, law firms and businesses: a Ukrainian national who acted as a Hive and Nefilim affiliate was sentenced in the US to 70 months.
In brief
- Artem Stryzhak, a 36-year-old Ukrainian national formerly of Barcelona, was sentenced to 70 months in prison, the US Department of Justice announced on 27 October 2026.
- He pleaded guilty in December 2025 to two counts of conspiracy to commit fraud and extortion in connection with computers, over his work as an affiliate of the Nefilim and Hive ransomware groups.
- According to the announcement, Hive attacked about 1,500 victims worldwide, including government bodies, hospitals and businesses. Stryzhak himself deployed the ransomware against seven victims, including law firms, a dental office and a healthcare provider.
- He was arrested in Spain in June 2024 and extradited to the United States in April 2025.
- Status: conviction on a guilty plea and sentencing. A co-conspirator named in the announcement, Volodymyr Tymoshchuk, remains at large and is presumed innocent.
What the case established
According to the US Department of Justice announcement, Stryzhak joined Nefilim as an affiliate around June 2021 and received access to the ransomware. He agreed to pay the group's administrators 20% of ransom proceeds. In a June 2021 attack on an oil and gas transportation company, according to the announcement, he stole data and created email addresses used in the ransom note. He kept working with Nefilim until at least October 2021 (US Department of Justice).
According to the same announcement, Stryzhak was also one of Hive's earliest affiliates. Between June 2021 and January 2023, Hive members attacked about 1,500 victims. Stryzhak deployed the ransomware against seven victims during the COVID-19 pandemic. The FBI gave one of them a decryption key, so that victim recovered its data without paying (US Department of Justice).
The damage
According to the Department of Justice, the groups caused more than USD 100 million in losses. One hospital hit by Hive had to stop using its digital systems for existing patients and could not immediately take in new ones (US Department of Justice).
Arrest, extradition and the co-conspirator at large
Stryzhak was arrested in Spain in June 2024 and extradited to the United States in April 2025. His guilty plea in the Nefilim case was also reported in December 2025 by the security news site BleepingComputer, which said the attacks targeted companies in the US, Norway, France, Switzerland, Germany and the Netherlands, among others (BleepingComputer). Volodymyr Tymoshchuk, named in the announcement as one of the Nefilim administrators, has been charged and remains at large. The US State Department offers up to USD 11 million for information leading to his arrest or conviction (US Department of Justice).
What businesses can learn from the case
The affiliate model lets ransomware groups rent out their tools to many attackers, so a small business, a clinic or a law firm can be hit too. In such an attack, data is stolen before encryption, and the threat is also that it will be exposed. Victims should keep logs, ransom notes and communication addresses, contact law enforcement and check the reporting duties that apply to them under data protection law.
Sources: US Department of Justice, 27.10.2026, BleepingComputer, 22.12.2025. The sources are in English.
Further reading: Fake profile: how to find out who is behind it, Fake reviews and impersonation: building an evidence file, and our digital attack investigations service.
The information in this section is general and is not legal advice. The defendant was convicted on his own guilty plea and has been sentenced. The co-conspirator at large has only been charged and is presumed innocent.
