Sentence, extradition, and arrest
A Ukrainian national, 35-year-old Artem Aleksandrovych Stryzhak, was sentenced to 70 months in prison for his role in Nefilim and Hive ransomware attacks that struck hospitals, government entities, and high-revenue businesses worldwide between 2018 and 2021. Authorities arrested Stryzhak in Spain in June 2024 and extradited him to the United States on April 30, 2025. In December 2025 he pleaded guilty to computer fraud conspiracy charges brought by U.S. prosecutors related to attacks on businesses in the United States, Norway, France, Switzerland, Germany, and the Netherlands.
Stryzhak's role in Nefilim and Hive operations
According to court documents, Stryzhak paid for 20% of all ransom payments collected for access to a custom Nefilim ransomware build and decryption keys beginning in June 2021. He remained active as a Nefilim affiliate until October 2021, using custom-tailored malware to target large corporations in the United States, Canada, and Australia whose annual revenues exceeded $100 million; one Nefilim administrator later encouraged him to focus on companies generating more than $200 million annually.
Stryzhak also joined Hive as an early affiliate. Prosecutors say he breached and encrypted the systems of seven Hive victims, among them a dentist's office, multiple law firms, and a healthcare provider during the COVID-19 pandemic.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildVictims, tactics, and financial impact
Prosecutors and FBI officials tied the activity to widespread harm: the Nefilim and Hive operations targeted hospitals and businesses, disrupted patient care, and caused more than $100 million in losses, the FBI said. To increase pressure on victims, the Nefilim operation maintained dark web "Corporate Leaks" websites managed by administrators that threatened to publish stolen data unless ransom demands were met. U.S. prosecutors said disrupting the group that attacked approximately 1,500 victims worldwide and sentencing a defendant who targeted healthcare during the pandemic was of significant importance to the office.
U.S. prosecutorial response and the hunt for Volodymyr Tymoshchuk
U.S. attorneys framed the sentence as part of a wider effort to hold ransomware actors accountable. U.S. Attorney Gregory W. Kehoe said the disruption and sentencing were significant, and U.S. Attorney Joseph Nocella Jr. warned that "ransomware attacks like those committed by the defendant wreak enormous havoc — harming victim companies that pay millions in remediation and ransoms, preventing hospitals and other critical facilities from accessing data, and putting sensitive information in the hands of bad actors."
The U.S. State Department is offering up to $11 million for information that could lead to the arrest of Ukrainian national Volodymyr Tymoshchuk, described in the charging documents as one of Stryzhak's alleged accomplices and still at large. Tymoshchuk is reported to be on the most-wanted lists of the European Union and the FBI and was charged by the U.S. Justice Department in September for roles as an administrator for LockerGoga, MegaCortex, and Nefilim. Prosecutors say he was allegedly involved in ransomware attacks that caused millions of dollars in damage to hundreds of companies between July 2020 and October 2021.
What this means for technologists, prosecutors, and hospitals
- Technologists and security teams: The case underscores the operational model where affiliates pay for access to bespoke ransomware builds and decryption tools — here, Stryzhak paid for 20% of collected ransoms for Nefilim access — and the use of public shaming via dark web "Corporate Leaks" sites. The Blue Report 2026 is cited in the story as measuring defenses technique by technique across 338 million simulations and notes that "overall prevention scores can hide what happens after initial access" and that prevention drops sharply once attackers are using valid credentials.
- Prosecutors and law enforcement: The extradition from Spain, the multinational scope of charges (U.S., Norway, France, Switzerland, Germany, the Netherlands), and the State Department bounty of up to $11 million for information on an alleged administrator signal continued reliance on cross-border cooperation and financial incentives to pursue actors who remain at large.
- Hospitals and affected enterprises: Prosecutors emphasized disrupted patient care and remediation costs running into millions, and the record in this case connects healthcare targeting during COVID-19 to broader global victimization—approximately 1,500 victims worldwide according to the charging office.
The sentence of 70 months for a defendant who admitted participating in both Nefilim and Hive operations ties a human face to a business model in which bespoke ransomware, affiliate networks, and extortion websites combine to extract payments from large organizations and to threaten public-facing services like health care. With an alleged administrator still at large and a multi-million-dollar reward on the table, the case leaves a clear, concrete next step: whether international partners will locate and bring to account the figures prosecutors say orchestrated and enabled these multilingual, multi-jurisdictional campaigns.
