INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Nefilim Affiliate Sentenced to 70 Months in Prison for Ransomware

| 2026-10-28 09:43 CRITICAL HIGH RANSOMWARE & EXTORTION DATA BREACH LAW ENFORCEMENT
JSON
Executive Summary
AI-generated
Artem Aleksandrovych Stryzhak, a Ukrainian national, was sentenced to 70 months in prison for his role in Nefilim and Hive ransomware attacks targeting hospitals, government entities, and high-revenue businesses worldwide between 2018 and 2021. The attacks affected approximately 1,500 victims globally. Stryzhak used custom-tailored malware to target large corporations in the United States, Canada, and Australia with revenues exceeding $100 million each year. He was an affiliate of Nefilim until October 2021 and later joined Hive ransomware, breaching systems of seven victims during the COVID-19 pandemic. Stryzhak pleaded guilty in December 2025 to computer fraud conspiracy charges brought by US prosecutors in connection with ransomware attacks targeting businesses in six countries.
Technical Mitigations AI-generated
• Use a reputable antivirus solution that includes threat intelligence and real-time protection to detect and block custom-tailored malware like Nefilim ransomware. • Implement robust network segmentation, monitoring, and incident response plans to quickly identify and contain lateral movement by attackers using valid credentials. • Regularly review and update system configurations, software patches, and security controls to prevent exploitation of known vulnerabilities exploited in Hive ransomware attacks.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
LockerGogaLockerGogaMegaCortexMegaCortex
Target & Sectors
NORTH_AMERICA NORTH_AMERICA DACH DACH BENELUX BENELUX NORDICS NORDICS governmentgovernment healthhealth
Incident Timeline
‎between July 2020
Threat actors affiliated with the Nefilim and Hive ransomware groups allegedly caused millions of dollars in damages to hundreds of companies worldwide between July 2020 and October 2021.
tactic Ransomware
He was also allegedly involved in ransomware attacks that caused millions of dollars in damages to hundreds of companies around the world between July 2020 and October 2021.
‎June 2021
A person paid for 20% of all ransom payments collected for access to custom Nefilim ransomware and decryption keys starting in June 2021.
tactic Ransomware
" According to court documents, he paid for 20% of all ransom payments collected for access to custom Nefilim ransomware and decryption keys starting in June 2021.
general_metric 20 %
" According to court documents, he paid for 20% of all ransom payments collected for access to custom Nefilim ransomware and decryption keys starting in June 2021.
‎October 2021
A Nefilim ransomware affiliate, later joined by Hive ransomware, used custom-tailored malware to target hundreds of companies worldwide between July 2020 and October 2021.
target_region United States
While active as a Nefilim affiliate until October 2021, Stryzhak used the custom-tailored malware to target large corporations in the United States, Canada, and Australia with revenues exceeding $100 million each year.
target_region Canada
While active as a Nefilim affiliate until October 2021, Stryzhak used the custom-tailored malware to target large corporations in the United States, Canada, and Australia with revenues exceeding $100 million each year.
target_region Australia
While active as a Nefilim affiliate until October 2021, Stryzhak used the custom-tailored malware to target large corporations in the United States, Canada, and Australia with revenues exceeding $100 million each year.
financial $100 revenues
While active as a Nefilim affiliate until October 2021, Stryzhak used the custom-tailored malware to target large corporations in the United States, Canada, and Australia with revenues exceeding $100 million each year.
tactic Ransomware
He was also allegedly involved in ransomware attacks that caused millions of dollars in damages to hundreds of companies around the world between July 2020 and October 2021.
organisation COVID-19
Nefilim ransom note (BleepingComputer) ​Stryzhak also joined Hive ransomware as an early affiliate, breaching and encrypting the systems of seven victims, including a dentist's office, multiple law firms, and a healthcare provider during the COVID-19 pandemic.
organisation The Blue Report 2026
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
financial $200 companies
However, one of the Nefilim administrators later encouraged him to focus on large companies that were generating more than $200 million annually.
‎June 2024
Artem Aleksandrovych Stryzhak was extradited to the United States and subsequently sentenced to 70 months in prison.
target_region United States
The sentence follows the extradition of 35-year-old Artem Aleksandrovych Stryzhak to the United States on April 30, 2025, after authorities arrested him in Spain in June 2024.
source_region Spain
The sentence follows the extradition of 35-year-old Artem Aleksandrovych Stryzhak to the United States on April 30, 2025, after authorities arrested him in Spain in June 2024.
financial $100 revenues
"These groups disrupted patient care and caused more than $100 million in losses.
organisation Cyber Branch Operations
"Artem Stryzhak is a prolific cybercriminal who worked with multiple ransomware groups to target U.S. businesses and hospitals," said Brett Leatherman, the FBI's Cyber Branch Operations Director.
‎April 30, 2025
Artem Aleksandrovych Stryzhak, a 35-year-old ransomware affiliate linked to the Nefilim and Hive groups, was extradited to the United States on April 30, 2025.
target_region United States
The sentence follows the extradition of 35-year-old Artem Aleksandrovych Stryzhak to the United States on April 30, 2025, after authorities arrested him in Spain in June 2024.
source_region Spain
The sentence follows the extradition of 35-year-old Artem Aleksandrovych Stryzhak to the United States on April 30, 2025, after authorities arrested him in Spain in June 2024.
industry Health
General Document Context
industry Government
General Document Context
‎December 2025
The US Justice Department charged and convicted a Ukrainian national, Stryzhak, for his roles as an administrator in ransomware gangs targeting approximately 1,500 victims worldwide.
target_region United States
In December 2025, Stryzhak pleaded guilty and admitted to computer fraud conspiracy charges brought by US prosecutors in connection with ransomware attacks targeting businesses in the United States, Norway, France, Switzerland, Germany, and the Netherlands.
target_region Norway
In December 2025, Stryzhak pleaded guilty and admitted to computer fraud conspiracy charges brought by US prosecutors in connection with ransomware attacks targeting businesses in the United States, Norway, France, Switzerland, Germany, and the Netherlands.
target_region France
In December 2025, Stryzhak pleaded guilty and admitted to computer fraud conspiracy charges brought by US prosecutors in connection with ransomware attacks targeting businesses in the United States, Norway, France, Switzerland, Germany, and the Netherlands.
target_region Switzerland
In December 2025, Stryzhak pleaded guilty and admitted to computer fraud conspiracy charges brought by US prosecutors in connection with ransomware attacks targeting businesses in the United States, Norway, France, Switzerland, Germany, and the Netherlands.
target_region Germany
In December 2025, Stryzhak pleaded guilty and admitted to computer fraud conspiracy charges brought by US prosecutors in connection with ransomware attacks targeting businesses in the United States, Norway, France, Switzerland, Germany, and the Netherlands.
target_region Netherlands
In December 2025, Stryzhak pleaded guilty and admitted to computer fraud conspiracy charges brought by US prosecutors in connection with ransomware attacks targeting businesses in the United States, Norway, France, Switzerland, Germany, and the Netherlands.
tactic Ransomware
In December 2025, Stryzhak pleaded guilty and admitted to computer fraud conspiracy charges brought by US prosecutors in connection with ransomware attacks targeting businesses in the United States, Norway, France, Switzerland, Germany, and the Netherlands.
"Ransomware attacks like those committed by the defendant wreak enormous havoc — harming victim companies that pay millions in remediation and ransoms, preventing hospitals and other critical facilities from accessing data, and putting sensitive information in the hands of bad actors," US Attorney Joseph Nocella Jr. noted.
victims 1,500 victims
"Disrupting a ransomware group that attacked approximately 1,500 victims worldwide and sentencing a defendant who had targeted healthcare during the COVID-19 pandemic is of significant importance to this office," added US Attorney Gregory W. Kehoe.
organisation The US State Department
The US State Department also offers up to $11 million for any details that could lead to the arrest of Ukrainian national Volodymyr Tymoshchuk, one of Stryzhak's alleged accomplices, who is still at large.
organisation Volodymyr Tymoshchuk
The US State Department also offers up to $11 million for any details that could lead to the arrest of Ukrainian national Volodymyr Tymoshchuk, one of Stryzhak's alleged accomplices, who is still at large.
financial $11 Department
The US State Department also offers up to $11 million for any details that could lead to the arrest of Ukrainian national Volodymyr Tymoshchuk, one of Stryzhak's alleged accomplices, who is still at large.
organisation the European Union
Tymoshchuk is on the most-wanted lists of the European Union and the FBI , and the US Justice Department charged him in September for his roles as an administrator for the LockerGoga, MegaCortex, and Nefilim ransomware gangs.
organisation the US Justice Department
Tymoshchuk is on the most-wanted lists of the European Union and the FBI , and the US Justice Department charged him in September for his roles as an administrator for the LockerGoga, MegaCortex, and Nefilim ransomware gangs.
‎between 2018 and 2021
A Ukrainian national was sentenced to 70 months in prison for his role in Nefilim and Hive ransomware attacks targeting hospitals, government entities, and high-revenue businesses worldwide between 2018 and 2021.
tactic Ransomware
A Ukrainian national was sentenced to 70 months in prison for his role in Nefilim and Hive ransomware attacks targeting hospitals, government entities, and high-revenue businesses worldwide between 2018 and 2021.
target_region Ukraine
A Ukrainian national was sentenced to 70 months in prison for his role in Nefilim and Hive ransomware attacks targeting hospitals, government entities, and high-revenue businesses worldwide between 2018 and 2021.
‎2026/10/28
The FBI sentenced a Nefilim and Hive ransomware affiliate to 70 months in prison.
attribution FBI
Today's sentence reflects the seriousness of Stryzhak's crimes and demonstrates the FBI's global reach and extensive network of international partners.
‎2026/10/28
A Nefilim and Hive ransomware affiliate was sentenced to 70 months in prison.
organisation Hive
Nefilim and Hive ransomware affiliate gets 70 months in prison.
Tactical Metrics
Metrics
financial
100,000,000
Financial Impact / Stolen Funds
While active as a Nefilim affiliate until October 2021, Stryzhak used the custom-tailored malware to target large corporations in the United States, Canada, and Australia with revenues exceeding $100 million each year.
"These groups disrupted patient care and caused more than $100 million in losses.
Metrics
victims
1,500
Victims
"Disrupting a ransomware group that attacked approximately 1,500 victims worldwide and sentencing a defendant who had targeted healthcare during the COVID-19 pandemic is of significant importance to this office," added US Attorney Gregory W. Kehoe.
Metrics
financial
11,000,000
Financial Impact / Stolen Funds
The US State Department also offers up to $11 million for any details that could lead to the arrest of Ukrainian national Volodymyr Tymoshchuk, one of Stryzhak's alleged accomplices, who is still at large.
Metrics
financial
200,000,000
Financial Impact / Stolen Funds
However, one of the Nefilim administrators later encouraged him to focus on large companies that were generating more than $200 million annually.
Intelligence Sources
BleepingComputer 2026-10-28