US Court Sentences Ransomware Affiliate to 70 Months

"Stryzhak was a prolific cybercriminal," Brett Leatherman, assistant director at the FBI’s cyber branch, said in court filings.

Sentence handed down in New York federal court

Artem Stryzhak, a Ukrainian national, was sentenced to 70 months in prison by a New York federal court for his role as an affiliate of the Nefilim and Hive ransomware operations. Prosecutors say Stryzhak began working with Nefilim in or around June 2021 while living in Barcelona, Spain, and subsequently joined Hive as "one of its earliest affiliates."

Nefilim: targeting wealthy companies, revenue tiers specified

Court documents state that Nefilim operated as a ransomware-as-a-service (RaaS) enterprise that encouraged affiliates to pursue businesses able to pay substantial ransom demands. Prosecutors say Stryzhak agreed with alleged Nefilim boss Volodymyr Tymoshchuk to pay the ransomware crew a 20 percent cut of ransom proceeds he collected. Tymoshchuk reportedly told Stryzhak his preference was to attack companies based in the United States, Canada, and Australia that have more than $100 million annually in revenue; that guidance was later tweaked to target companies in the same regions with more than $200 million in annual revenue.

Hive: early affiliate, seven known victims, wider toll

According to the prosecution, Stryzhak used the Hive platform to attack roughly seven victims. Hive's operators themselves claimed to have targeted about 1,500 victims worldwide between June 2021 and January 2023. Separate court filings list specific Hive victims, including a law firm and an Ohio hospital that paid approximately $1.7 million in Bitcoin after the gang initially demanded $2 million during the COVID‑19 pandemic.

Hive was known, before its infrastructure was seized in an international law enforcement operation in January 2023, for attacks on healthcare facilities during the COVID‑19 pandemic and for being one of the ransomware groups that targeted Costa Rica in 2022.

Scale of harm and law enforcement response

Prosecutors attribute more than $100 million in victim damages to the groups in which Stryzhak participated. Brett Leatherman characterized Stryzhak as a significant player and emphasized the FBI's global reach and international partnerships in bringing him to justice. Stryzhak was arrested by Spanish police in June 2024 and extradited to the United States in April 2025. The Justice Department used the sentencing announcement to remind the public that rewards totaling up to $11 million are available for qualifying information about alleged Nefilim operator Volodymyr Tymoshchuk and other key ransomware suspects.

What this means for technologists and security teams, policymakers, and affected enterprises

• Technologists and security teams: the Nefilim guidance documented in court filings — prioritizing larger revenue targets in specific countries — underlines how some RaaS models actively steer affiliates toward high-value corporate victims; defenders should watch for extortion patterns and leverage threat-sharing channels about actor-preferred targets and ransom demand sizing.
• Policymakers and regulators: the international law enforcement actions cited in the record, and the $11 million reward offer announced by the Justice Department, illustrate reliance on cross-border cooperation and financial incentives as tools for disrupting organized ransomware operations.
• Affected enterprises and procurement leaders: the case highlights the economic calculus embedded in some RaaS operations — affiliates were urged to seek out firms with $100 million to $200 million+ in revenue — which should factor into risk assessments for firms of that size and for subsidiaries in the United States, Canada, and Australia.

The sentence closes one chapter in the U.S. prosecution of Nefilim and Hive affiliates, but the record as presented in court files leaves the primary alleged Nefilim operator, Volodymyr Tymoshchuk, at large. Law enforcement statements accompanying the sentence reiterate an ongoing effort to locate co‑conspirators and employ every available tool to do so, while offering substantial rewards for actionable tips. The immediate legal consequence for Stryzhak is clear; the broader campaign to dismantle the networks that encouraged and facilitated these attacks will hinge on international cooperation and the public tips that may follow.

Source: The Register — Serial ransomware crook gets 70 months behind bars for Nefilim, Hive roles