Nefilim and Hive affiliate Stryzhak gets 70 months

The US Department of Justice sentenced Artem Stryzhak, a 36-year-old Ukrainian national, to 70 months in prison for his role as an affiliate of the Nefilim and Hive ransomware operations. Stryzhak pleaded guilty in December 2025 to two counts of conspiracy to commit fraud, extortion, and related activity in connection with computers. Across both operations, DOJ says the groups caused more than $100 million in losses.

What the case covers

Per the DOJ release, Stryzhak became a Nefilim affiliate around June 2021, paying the ransomware-as-a-service administrators 20% of the proceeds in exchange for access to the malware and decryption keys. Nefilim's targeting was deliberate: US, Canadian, and Australian companies with annual revenue above $100 million. He was also one of the earliest Hive affiliates; DOJ says his Hive team deployed ransomware against seven victims, including a dentist's office, multiple law firms, and a healthcare provider during the pandemic. Hive as a whole hit roughly 1,500 victims worldwide between June 2021 and January 2023.

The two prosecutions ran in parallel: the Eastern District of New York handled the Nefilim conduct, the Middle District of Florida the Hive conduct. Stryzhak was arrested in Spain in June 2024 and extradited to the US on 30 April 2025.

What this means for defenders

There is no patch here — this is attribution made official by a court, which is the bar we hold for naming individuals. A few operational notes carry over:

1. The affiliate model is what's being dismantled. Stryzhak rented access to two different RaaS brands; taking an affiliate off the board doesn't kill the malware, but it raises the cost and risk of the affiliate economy that both groups ran on.
2. A co-conspirator is still out. DOJ notes Volodymyr Tymoshchuk remains at large, with an $11 million US State Department reward for information. Hunt-team leads on either brand's historical TTPs are still worth chasing.
3. The named verticals held steady — healthcare, legal, and mid-market firms above the $100M revenue line. If you sit in that profile, revisit your Nefilim/Hive IOC retention and backup-recovery drills.

Context

This follows a run of ransomware-affiliate extraditions and sentencings reaching defendants who operated from outside the usual non-extradition bloc. The pattern is slow but consistent: arrests in cooperating countries, extradition, a guilty plea, and a multi-year sentence tied to a specific affiliate account rather than a faceless "group." Attribution stops being a hedge once a court signs off — and here it did.