Artem Stryzhak sentenced to 70 months for Hive and Nefilim attacks

The Justice Department said Artem Stryzhak, 36, received 70 months on Oct. 27, 2026, for computer fraud conspiracy tied to ransomware attacks against businesses worldwide, law firms, government entities, and hospitals.

In December 2025, Stryzhak entered guilty pleas on two counts of conspiracy involving fraud, extortion, and computer-related activity. In June 2024, authorities arrested him in Spain. Authorities extradited him to the United States in April 2025.

The Justice Department said Stryzhak took part in attacks from the middle of 2018 to late 2021. Court documents place his Nefilim involvement from around June 2021 through at least October 2021.

As a Nefilim affiliate, Stryzhak agreed to pay 20% of ransom proceeds extorted from victims to Nefilim administrators, including Volodymyr Tymoshchuk, in exchange for access to Nefilim ransomware. If a Nefilim victim paid the demanded ransom, the attackers handed over a decryption key allowing the victim to release files scrambled by the malware.

The cartel launched in 2020 and shared much of its code with Nemty ransomware. It locked files using AES-128 encryption, a method that scrambles data so it cannot be read without the proper key, and added the.NEFILIM extension to encrypted files. Nefilim is believed to have rebranded under other names including Fusion, Milihpen, Gangbang, Nemty, and Karma. Toll Group, Orange, and Whirlpool were among companies hit by Nefilim attacks.

Nefilim went after companies in the United States, Canada, and Australia with yearly revenue above $100 million, threatening to leak stolen data unless victims paid. After breaking into networks, the Nefilim crew studied target companies to learn their net worth, size, and contact details. Officials said the attacks produced millions of dollars in losses from extortion payments and damage to victim networks.

Prosecutors said Stryzhak and co-conspirators released Nefilim ransomware on computer networks in Germany, the Netherlands, Norway, and Switzerland. Authorities said Stryzhak and co-conspirators altered executable ransomware files for every victim, producing unique decryption keys and unique ransom notes.

In June 2021, Stryzhak took data from an oil and gas transportation company. Roughly seven days after that, he created e-mail addresses that showed up in a ransom note sent to the victim. The conspiracies caused serious harm to victim computer systems.

Among his American victims were a French engineering consulting firm, an aviation company in New York, and an Ohio chemical company. The list of American victims also covered an Illinois insurance company, a Texas construction firm, a Missouri pet care business, and an international eyewear company.

While acting as a Hive affiliate, Stryzhak and accomplices released Hive ransomware on seven targets during the COVID-19 pandemic. Those seven targets covered legal practices, a dental office, and a medical provider, and each lost access to encrypted information.

In one Hive incident, a hospital stopped using digital technology to treat current patients and could not admit new patients immediately. Hive attacks seriously disrupted daily operations for victims around the world and affected responses to the COVID-19 pandemic.

From June 2021 to January 2023, Hive conspirators struck roughly 1,500 victims worldwide, including government entities, hospitals, and businesses. The FBI said the ransomware cartels disrupted patient care and caused losses exceeding $100 million.

The FBI provided a decryption key to one victim of Stryzhak during a months-long disruption campaign against Hive, allowing that victim to decrypt data without paying a ransom.

The Justice Department offered $15 million for information on other Hive members. The State Department‘s Transnational Organized Crime Rewards Program offered up to $11 million for tips that lead to the arrest, conviction, or location of Tymoshchuk.

Authorities continue to seek alleged co-conspirator Volodymyr Tymoshchuk. Prosecutors said Tymoshchuk also administered the LockerGoga and MegaCortex ransomware cartels. Joseph Nocella Jr. said authorities “remain determined to capture Volodymyr Tymoshchuk.”

Federal investigators in Springfield worked the Nefilim case, while Tampa FBI agents worked the Hive case. Stryzhak faced conspiracy charges in Brooklyn federal court, and prosecutors unsealed the indictment there. After his extradition in 2025, Stryzhak faced up to five years in prison if convicted.

Since 2020, CCIPS has won convictions against more than 180 cyber and intellectual property criminals and secured court orders returning over $350 million to victims. The Justice Department called the sentence the end of a years-long, multi-continent investigation into cyber attacks against Americans’ businesses and health care.

A. Tysen Duva said, “This sentence concludes a years-long, multi-continent investigation into a defendant who participated in cyber-attacks against Americans’ businesses and health care.” U.S. authorities have gone after ransomware affiliates based overseas using extradition agreements with allied nations, according to commentary on the Stryzhak case.