A Ransomware Affiliate Who Worked for Both Nefilim and Hive Gets Nearly Six Years in U.S. Prison
Ukrainian national Artem Stryzhak was sentenced to 70 months in prison for his role as an affiliate of the Nefilim and Hive ransomware operations, whose victims ranged from large corporations to a dentist’s office and law firms. Here are the key questions answered.
A U.S. federal court has sentenced Artem Stryzhak, a Ukrainian national, to 70 months in prison for carrying out ransomware attacks as an affiliate of two different gangs. Details below come from BleepingComputer’s report on the sentencing, with added background from The Record.
Your questions, answered
What is a ransomware affiliate?
Ransomware gangs often split the work. Administrators build the malware and run the extortion websites, while affiliates break into victims and deploy it. In return, the administrators take a share. Under the Nefilim arrangement, Stryzhak paid them 20% of each ransom, starting in June 2021.
Who did he go after?
With Nefilim, the focus was big companies in the United States, Canada and Australia with more than $100 million in annual revenue. One administrator pushed him toward firms making more than $200 million. Victims who would not pay were threatened with having their stolen data posted on “Corporate Leaks” sites run by the Nefilim administrators.
Hive was different. Stryzhak was one of its earliest affiliates, and The Record reports he worked with the group from October 2021 to January 2023. BleepingComputer says he attacked seven victims through Hive, including a dentist’s office, several law firms and a healthcare provider during the COVID-19 pandemic.
How was he caught and charged?
He was arrested in Spain in June 2024 and extradited to the United States on April 30, 2025. He pleaded guilty in December 2025 to computer fraud conspiracy charges.
How much damage are we talking about?
An FBI official said the groups behind these attacks disrupted patient care and caused more than $100 million in losses. The Record notes that one Hive attack left a hospital unable to accept new patients.
Is everyone involved in custody?
No. Volodymyr Tymoshchuk, described as an administrator of the LockerGoga, MegaCortex and Nefilim operations, is still at large, with a U.S. reward of up to $11 million for information about him. The Justice Department has also offered $15 million for information on other Hive members.
What the sentence does and does not change
- It does show that affiliates, not only gang leaders, can be tracked, arrested abroad and extradited, even years after the attacks.
- It does not slow down the business model. Affiliates move between gangs, as this case shows, and new gangs keep recruiting.
- It does not help past victims get their data back or undo the downtime they suffered.
What this means for your company
Nefilim chased large corporations, but Hive’s list included a dentist’s office and law firms. The same person, using the same skills, hit both. Small and midsized businesses are not too small to be targeted, especially in healthcare and professional services. Arrests are welcome, but they come years after the damage is done. Your protection comes from the basics: multifactor sign-in on remote access and email, prompt patching of internet-facing systems, backups kept where attackers cannot reach them, and a tested plan for the day your files are locked.
Wondering how your business would hold up against the kind of attacks these affiliates carried out? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
