BARCELONA, October 30, 2026 — Artem Stryzhak received a 70-month federal prison sentence for his role as a paid affiliate within the Nefilim and Hive ransomware networks.
The Mechanics of a Pay-to-Hack Enterprise
The conviction of Stryzhak exposes the operational architecture behind modern ransomware-as-a-service platforms, which functioned as scalable criminal empires rather than simple hacking scripts. Court records unsealed by the Justice Department indicate that Stryzhak entered the Nefilim operation in approximately June 2021 under a specific profit-sharing structure. Administrators, including Volodymyr Tymoshchuk, provided him with entry to the ransomware codebase in exchange for a 20 percent cut of every ransom extracted from victims.
This contractor-style arrangement granted Stryzhak the latitude to run a second, substantially larger criminal enterprise simultaneously. He deployed Nefilim and Hive against hospitals during active COVID-19 surges, forcing at least one medical facility onto paper-based workflows and blocking new patient admissions. The technical reality of these attacks involved customizing executable ransomware files for each victim, creating unique decryption keys and unique ransom notes tailored to the specific network architecture of the target.
The targeting methodology was precise: the crew researched companies after breaching their networks to determine net worth, size, and contact information. They specifically pursued organizations in the United States, Canada, and Australia with annual revenues exceeding $100 million, including entities in aviation, chemical processing, insurance, construction, oil and gas transportation, law firms, and pet care.
The Scale of Extraction
Stryzhak’s involvement extended across seven distinct victims during the pandemic alone. The financial toll included millions of dollars in direct extortion payments from those who chose to pay, alongside significant costs for remediation and data recovery for those who did not. Prosecutors noted that the operation also caused substantial damage to victim networks in Germany, the Netherlands, Norway, and Switzerland.
The group attacked approximately 1,500 victims worldwide between mid-2018 and late 2021. Stryzhak was arrested in Spain in June 2024 and extradited to the United States in April 2025, where he pleaded guilty to multiple cybercrimes in late 2025.
The Implications for Cybersecurity
This sentence represents a critical milestone in dismantling the affiliate model that allowed ransomware groups to scale their operations globally. By prosecuting Stryzhak, authorities have demonstrated that operating from abroad or utilizing sophisticated encryption does not provide immunity under U.S. jurisdiction. The conviction validates the Justice Department’s assertion that cybercriminals terrorizing American businesses and healthcare infrastructure can be held accountable regardless of their physical location.
The case also highlights the vulnerability of critical infrastructure operators to targeted, customized attacks. For security teams reviewing threat intelligence on Nefilim and Hive, this verdict underscores the necessity of detecting not just the malware signature, but the behavioral patterns of affiliates who may be operating with full knowledge of the platform’s capabilities.
The Global Reach and Specific Victim Profile
The criminal enterprise operated with a distinct geographic focus, prioritizing high-value targets in the United States, Canada, and Australia that generated annual revenues exceeding $100 million. This selection process involved deep reconnaissance where the crew researched companies after breaching their networks to determine net worth, size, and contact information before initiating attacks. Specific industries identified for targeting included aviation, chemical processing, insurance, construction, oil and gas transportation, law firms, and pet care.
A notable subset of victims included an engineering consulting company based in France, an aviation industry company in New York, a chemical company in Ohio, an insurance company in Illinois, a construction firm in Texas, a pet care company in Missouri, and an international eyewear company. Beyond North America, prosecutors confirmed that the group utilized Nefilim ransomware to encrypt victim networks located in Germany, the Netherlands, Norway, and Switzerland, demonstrating the operation’s transnational scope.
The impact on healthcare infrastructure was particularly severe, with Stryzhak deploying attacks against hospitals during active COVID-19 surges. These incidents forced at least one medical facility onto paper-based workflows and blocked new patient admissions, disrupting critical care delivery. The financial toll included millions of dollars in direct extortion payments from those who chose to pay, alongside significant costs for remediation and data recovery for organizations that refused to comply with demands.
The Pay-to-Hack Model and Profit-Sharing Structure
According to court records unsealed by the Justice Department, Artem Stryzhak entered the Nefilim ransomware operation in approximately June 2021 under a specific profit-sharing structure. Administrators, including Volodymyr Tymoshchuk, provided him with entry to the ransomware codebase in exchange for a 20 percent cut of every ransom extracted from victims. This contractor-style arrangement granted Stryzhak the latitude to run a second, substantially larger criminal enterprise simultaneously. Within weeks of activating his platform account, he moved against a firm in the oil and gas transportation industry, exfiltrating its data and then configuring contact email addresses that appeared inside the ransom demand the company received. That arrangement gave Stryzhak the latitude to run a second, substantially larger criminal enterprise at the same time.
Stryzhak came aboard Hive as one of its earliest affiliates. From June 2021 through January 2023, Hive’s campaign reached roughly 1,500 targets around the world, encompassing hospital networks, government bodies, and private enterprises spanning multiple continents. The ransomware group primarily targeted companies located in the United States, Canada and Australia with more than $100 million in annual revenue, and extorted victims by threatening to publish stolen data. The crew researched companies after it broke into their networks to determine their net worth, size and contact information. Stryzhak and his co-conspirators allegedly customized executable ransomware files for each victim, creating unique decryption keys and unique ransom notes. Authorities said Stryzhak was one of the earliest Hive affiliates and, with co-conspirators, deployed the ransomware against seven victims during the COVID-19 pandemic.
Sources
- Ransomware affiliate who targeted hospitals during COVID-19 sentenced to 70 months in U.S. prison
- The Nefilim
- Prolific Hive and Nefilim ransomware affiliate sentenced to 70 months in prison
Photo: Wikimedia Commons (CC BY-SA 3.0)
