INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Nefilim Ransomware Affiliate Sentenced to 70 Months in Prison

| 2026-10-27 18:33 CRITICAL LOW RANSOMWARE & EXTORTION DATA BREACH LAW ENFORCEMENT
JSON
Executive Summary
AI-generated
A Ukrainian national, Artem Aleksandrovych Stryzhak, was sentenced to 70 months in prison for participating in a string of ransomware attacks targeting various critical infrastructure operators and businesses from the middle of 2018 to late 2021. The attacks, which used Nefilim ransomware, affected approximately 1,500 victims worldwide, including companies with annual revenues exceeding $100 million in the United States, Canada, and Australia. Stryzhak's victims in the US included an engineering consulting company based in France, aviation industry companies in New York and Texas, a chemical company in Ohio, insurance companies in Illinois, pet care companies in Missouri, and international eyewear companies. The attackers researched their targets to determine net worth, size, and contact information before extorting them with threats of publishing stolen data; they also customized executable ransomware files for each victim, creating unique decryption keys and notes.
Technical Mitigations AI-generated
• Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
BENELUX BENELUX NORDICS NORDICS NORTH_AMERICA NORTH_AMERICA DACH DACH energyenergy governmentgovernment legallegal aviationaviation healthhealth transportationtransportation
Incident Timeline
‎the middle of 2018
A 36-year-old Ukrainian national was sentenced to 70 months in prison for participating in a string of ransomware attacks targeting various critical infrastructure operators and businesses from the middle of 2018 to late 2021.
tactic Ransomware
A 36-year-old Ukrainian national was sentenced to 70 months in prison for participating in a string of ransomware attacks targeting various critical infrastructure operators and businesses from the middle of 2018 to late 2021, the Justice Department said Tuesday.
target_region Ukraine
A 36-year-old Ukrainian national was sentenced to 70 months in prison for participating in a string of ransomware attacks targeting various critical infrastructure operators and businesses from the middle of 2018 to late 2021, the Justice Department said Tuesday.
organisation the Justice Department
A 36-year-old Ukrainian national was sentenced to 70 months in prison for participating in a string of ransomware attacks targeting various critical infrastructure operators and businesses from the middle of 2018 to late 2021, the Justice Department said Tuesday.
‎June 2024
The prolific Hive and Nefilim ransomware affiliate was arrested in Spain in June 2024 and extradited to the United States in April 2025.
source_region Spain
He was arrested in Spain in June 2024 and extradited to the United States in April 2025.
source_region United States
He was arrested in Spain in June 2024 and extradited to the United States in April 2025.
‎April 2025
The prolific Hive and Nefilim ransomware affiliate, identified as Stryzhak, was extradited to the United States from Spain in April 2025 after a multi-continent investigation.
source_region Spain
He was arrested in Spain in June 2024 and extradited to the United States in April 2025.
source_region United States
He was arrested in Spain in June 2024 and extradited to the United States in April 2025.
organisation COVID-19
Authorities said Stryzhak was one of the earliest Hive affiliates and, with co-conspirators, deployed the ransomware against seven victims during the COVID-19 pandemic.
organisation the Justice Department’s Criminal Division
“This sentence concludes a years-long, multi-continent investigation into a defendant who participated in cyberattacks against Americans’ businesses and health care,” A. Tysen Duva, assistant attorney general of the Justice Department’s Criminal Division, said in a statement.
financial $11 reward
Authorities are still looking for his alleged co-conspirator Volodymyr Tymoshchuk and previously announced a $11 million reward for information leading to his arrest or conviction.
‎late 2025
Stryzhak pleaded guilty to multiple cybercrimes in late 2025.
‎2026/10/27
Artem Aleksandrovych Stryzhak, a prolific ransomware affiliate, was sentenced to 70 months in prison for his involvement with the Hive and Nefilim groups.
organisation Hive
He joined various ransomware groups during his crime spree, including Nefilim and Hive, which attacked about 1,500 victims worldwide.
victims 1,500 victims
He joined various ransomware groups during his crime spree, including Nefilim and Hive, which attacked about 1,500 victims worldwide.
organisation Ransomware
“Ransomware attacks like those committed by the defendant wreak enormous havoc — harming victim companies that pay millions in remediation and ransoms, preventing hospitals and other critical facilities from accessing data, and putting sensitive information in the hands of bad actors,” Joseph Nocella Jr., U.S. attorney for the Eastern District of New York, said in a statement.
Tactical Metrics
Metrics
victims
1,500
Victims
He joined various ransomware groups during his crime spree, including Nefilim and Hive, which attacked about 1,500 victims worldwide.
Metrics
financial
11,000,000
Reward
Authorities are still looking for his alleged co-conspirator Volodymyr Tymoshchuk and previously announced a $11 million reward for information leading to his arrest or conviction.
Intelligence Sources
CyberScoop 2026-10-27