Federal judge sentences Ukrainian affiliate of Hive and Nefilim ransomware gangs to 70 months

A United States court sentenced Ukrainian national Artem Aleksandrovych Stryzhak, 35, to 70 months in prison for his involvement in Nefilim and Hive ransomware operations. Stryzhak was arrested in Spain in June 2024 and extradited to the United States on April 30, 2025, before pleading guilty in December 2025 to computer fraud conspiracy charges. [2][3]

Court documents reveal that Stryzhak operated as an affiliate starting in June 2021, handing over 20% of ransoms he extracted in exchange for customized Nefilim ransomware and decryption keys. He targeted organizations with annual revenues topping $100 million across the United States, Canada, and Australia, while administrators threatened to post stolen files on dark web leak sites if targets refused to pay. Working as an early Hive affiliate, he also breached seven victims during the COVID-19 pandemic, hitting law firms, a dentist's office, and a healthcare provider. [3]

Brett Leatherman, the FBI's Cyber Branch Operations Director, stated that the ransomware groups Stryzhak worked alongside disrupted medical care and inflicted over $100 million in financial losses. One alleged accomplice, Ukrainian national Volodymyr Tymoshchuk, remains at large with the U.S. State Department offering a reward of up to $11 million for information leading to his arrest. [3]