Ukrainian Nefilim and Hive ransomware affiliate Artem Stryzhak sentenced to 70 months in US prison; The Record says his 2021 Nefilim attacks hit organisations in the US, Canada and Australia
The US Justice Department announced on 27 October 2026 that Artem Stryzhak, 36, a Ukrainian national formerly of Barcelona, Spain, was sentenced to 70 months in prison for conspiracy to commit computer fraud over ransomware attacks on hospitals, government entities, law firms and other businesses.
According to the DOJ, he joined the Nefilim conspiracy as an affiliate from about June 2021, agreeing to pay Nefilim administrators including Volodymyr Tymoshchuk 20% of ransom proceeds; his Nefilim attacks included a June 2021 data theft from an oil and gas transportation company, and he worked with Nefilim until at least October 2021.
The DOJ says he was also one of Hive's earliest affiliates and deployed Hive against seven victims, including law firms, a dentist office and a healthcare provider; the FBI gave a decryption key to one of them. He was arrested in Spain in June 2024, extradited in April 2025 and pleaded guilty in December 2025 to two counts of conspiracy.
The FBI's Brett Leatherman said the groups caused more than $100 million in losses. The US State Department offers up to $11 million for information on Tymoshchuk.
The Record (27 Oct) reports that throughout 2021 Stryzhak used Nefilim against organisations in the U.S., Canada and Australia.
- Product
- Nefilim and Hive ransomware
- Versions
- n/a — law-enforcement action
- Exploited in Australia?
- unknown
- Patch to
- No action for most readers. Information on Volodymyr Tymoshchuk can go to the FBI (reward up to $11 million, per DOJ).
- Primary: US Department of Justice — Ukrainian National Sentenced for Role in Hacking Hospitals, Businesses, and Governments as Part of Ransomware Conspiracies Causing Over $100 Million in Losses (27 Oct 2026)
- Source: The Record — Nefilim and Hive ransomware operator sentenced to 70 months (27 Oct 2026)