Nefilim, Hive ransomware operator given five-year-plus sentence after guilty plea

A former ransomware hacker was sentenced to 70 months in prison after pleading guilty last year to charges tied to several cyberattacks on hospitals, government entities and more. 

Artem Stryzhak, a 36-year-old from Ukraine, was an affiliate of the Nefilim ransomware group while living in Barcelona, Spain. Throughout 2021, Stryzhak used Nefilim to launch attacks on organizations in the U.S., Canada and Australia. 

Stryzhak paid Nefilim administrators, including indicted co-conspirator Volodymyr Tymoshchuk, a 20% fee of all ransoms extorted from victims. Stryzhak eventually moved on from Nefilim and joined the Hive ransomware gang — working with the group from October 2021 to January 2023. Tymoshchuk has evaded capture.

Stryzhak helped Hive attack organizations throughout the COVID-19 pandemic, targeting hospitals, governments and businesses. The group encrypted thousands of victims across 80 countries and earned millions in ransom payments throughout its run as a prominent ransomware gang. 

“Artem Stryzhak is a prolific cybercriminal who worked with multiple ransomware groups to target U.S. businesses and hospitals,” said Assistant FBI Director Brett Leatherman. “These groups disrupted patient care and caused more than $100 million in losses.”

Prosecutors listed one incident where a hospital was unable to accept new patients during the pandemic due to a Hive ransomware attack. The Hive ransomware gang was disrupted by the FBI after a months-long operation. 

Stryzhak was eventually arrested in Spain in June 2024 and extradited last April. He pleaded guilty in December 2025 to two counts of conspiracy to commit fraud, extortion, and related activity in connection with computers.

“This sentence concludes a years-long, multi-continent investigation into a defendant who participated in cyberattacks against Americans’ businesses and health care,” said Assistant Attorney General A. Tysen Duva.

Prosecutors said they are still searching for Tymoshchuk, who is also accused of being an administrator for the LockerGoga and MegaCortex ransomware gangs.

U.S. Attorney Joseph Nocella Jr. said they “remain determined to capture Volodymyr Tymoshchuk.”

The DOJ previously issued an $11 million reward for information on Tymoshchuk’s whereabouts and a $15 million reward for information on other members of Hive.