Artem Stryzhak sentenced to 70 months in US prison for Hive and Nefilim attacks

Sentenced in Brooklyn

Judge Pamela K. Chen imposed the term in federal court in Brooklyn. Stryzhak pleaded guilty in December 2025 to two conspiracy counts covering fraud, extortion and computer-related offenses, the Justice Department said. Spanish police arrested him in Barcelona in June 2024, and he was extradited to the United States in April 2025.

Seventy months sits below the ten-year maximum the court could have imposed, Cybernews reported. The FBI gave a decryption key to one of Stryzhak's victims, allowing it to recover its files without paying.

Hive's conspirators attacked about 1,500 victims worldwide between June 2021 and January 2023, according to court documents. That is a group-wide figure, not Stryzhak's own tally.

The FBI's New York field office, the Justice Department's Office of International Affairs and Spanish authorities helped locate, arrest and extradite him, the Justice Department said.

Why the hospital attacks matter

As a Hive affiliate, Stryzhak and his co-conspirators deployed ransomware against seven victims. They included a healthcare provider during the COVID-19 pandemic, a dental office and several law firms. One hospital hit by Hive had to stop using digital tools to treat existing patients. It was temporarily unable to accept new ones right after the attack, the Justice Department said. FBI operations director Brett Leatherman said the groups "disrupted patient care and caused more than $100 million in losses". That loss figure covers both operations, not Stryzhak's attacks alone.

Hive's broader victim list included an Ohio hospital that paid about $1.7 million in Bitcoin after the gang initially demanded $2 million, The Register reported.

In 2022 the US Department of Health and Human Services called Hive an "exceptionally aggressive" threat to the health sector, Bitdefender reported.

The Nefilim affiliate model

Stryzhak joined Nefilim around June 2021 and agreed to pay its administrators, Volodymyr Tymoshchuk among them, 20% of the ransom proceeds he extorted. Bitdefender put his own share at 80%. Nefilim targeted companies in the United States, Canada and Australia with annual revenue above $100 million. An administrator later pushed affiliates toward companies above $200 million, BleepingComputer reported. Prosecutors also listed Nefilim victims in Germany, the Netherlands, Norway and Switzerland.

In June 2021 he stole data from a company in the oil and gas transportation industry, then created the email addresses used in its ransom note about a week later, the Justice Department said.

The operation built a separate executable, decryption key and ransom note for each victim. It warned that stolen files would go to "Corporate Leaks" sites if a company refused to pay. Stryzhak stayed active as a Nefilim affiliate until at least October 2021.

The crew researched companies after it broke into their networks to determine their net worth, size and contact information, CyberScoop reported.

CyberScoop listed his US victims: an engineering consulting company based in France, an aviation company in New York, a chemical company in Ohio and an insurance company in Illinois. The list also included a construction company in Texas, a pet care company in Missouri and an international eyewear company.

Tymoshchuk still at large

Tymoshchuk, named in court records as a Nefilim administrator and as Stryzhak's co-defendant, remains at large. The State Department is offering up to $11 million for information leading to his arrest or conviction, including up to $10 million for Tymoshchuk and $1 million for other leaders of the groups he ran, SecurityWeek reported.

The Justice Department charged Tymoshchuk in September over his alleged roles as an administrator for LockerGoga, MegaCortex and Nefilim, BleepingComputer reported. He is on EU and FBI most-wanted lists.

Hive's infrastructure was seized by international law enforcement in January 2023. The FBI's infiltration of the gang saved victims more than $130 million in ransom payments, Bitdefender reported, citing the Justice Department.