Nefilim and Hive Renter Gets 70 Months in US Prison
Artem Stryzhak, a Ukrainian affiliate who rented Nefilim and Hive ransomware to hit companies, law firms, a dental office and a healthcare provider, was sentenced to 70 months in US prison.
Artem Stryzhak, a Ukrainian man who rented ransomware from both the Nefilim and Hive operations, has been sentenced to 70 months in a US prison, the Justice Department announced on Oct. 27. He pleaded guilty in December 2025 to two counts of conspiracy to commit computer fraud and extortion, BleepingComputer reports. Spanish police arrested him in Barcelona in June 2024, and he was extradited to the US in April 2025.
For defenders
The affiliate model: Stryzhak didn’t write the ransomware; he leased it. From about June 2021 he paid Nefilim’s administrators 20% of each ransom in exchange for a custom build and the decryption keys, and worked with them until at least October 2021, per the DOJ. BleepingComputer says one Nefilim administrator pushed him toward companies with more than $200 million in yearly revenue in the US, Canada and Australia. In one case the DOJ describes, he stole data from an oil and gas transportation company in June 2021 and sent the ransom note from email accounts he set up himself.
Hive victims: He was one of Hive’s earliest affiliates. The DOJ says he and co-conspirators hit seven victims during the pandemic, including law firms, a dental office and a healthcare provider. Across the whole operation, Hive attacked about 1,500 victims between June 2021 and January 2023, and the FBI puts combined losses from the two conspiracies above $100 million. One of Stryzhak’s victims recovered without paying because the FBI handed it a decryption key during its covert Hive disruption campaign.
Still at large: Alleged Nefilim, LockerGoga and MegaCortex administrator Volodymyr Tymoshchuk, charged in September 2025. The State Department offers up to $11 million for information on him. The cases were brought in the Eastern District of New York (Nefilim) and the Middle District of Florida (Hive). No new indicators were published with the sentencing.
What it means for you
Ransomware is now a rental business: one group builds the malware, and “affiliates” like Stryzhak break into companies and split the ransom. That’s why a dentist’s office or a small law firm can end up hit by the same tools used against big corporations. The sentence is good news, but the people who build these tools mostly stay out of reach, and new affiliates keep signing up.
Do this now
- Keep offline or immutable backups of your business data and test restoring them, so a ransom demand isn’t your only way back.
- Turn on two-factor sign-in for email, remote access and any admin accounts, the usual ways affiliates get in.
- If you’re hit, report it to the FBI at ic3.gov before paying. As one Hive victim found, the FBI may already hold a key.