A court sentenced Artem Stryzhak, a 36-year-old Ukrainian national, to 70 months in prison for working as an affiliate of the Nefilim and Hive ransomware operations. The sentence was handed down on October 27.
The Charges and the Guilty Plea
Stryzhak pleaded guilty in December 2025 to two counts of conspiracy to commit fraud and related activity in connection with computers. The sentence follows an arrest in Spain in June 2024 and an extradition to the United States in April 2026.
Stryzhak’s Role in Nefilim and Hive
Stryzhak was a Nefilim affiliate in 2021 while living in Barcelona. Under the affiliate arrangement he paid the group’s administrators 20 percent of the ransoms he collected. One of those administrators, indicted co-conspirator Volodymyr Tymoshchuk, remains at large.
Nefilim attacks in 2021 hit victims in the United States, Canada and Australia.
Move to the Hive Ransomware Operation
Stryzhak then worked with Hive from October 2021 to January 2023. Hive encrypted thousands of victims in 80 countries before the FBI disrupted the operation.
Nefilim Administrator Volodymyr Tymoshchuk Remains a Fugitive
The Nefilim administrator named as Stryzhak’s co-conspirator has not been arrested. Prosecutors say the affiliate paid a share of ransoms to the administrators, which ties the sentenced man to the people who ran the scheme. The sentence resolves one defendant’s case while leaving the operator-level figure free.
Losses and Victims Cited by the FBI
Assistant FBI Director Brett Leatherman said the groups caused more than $100 million in losses. He also said one hospital could not accept new patients during the pandemic because of an attack.
The victims of the two groups included hospitals, governments and businesses. The healthcare example is the one authorities cited to show harm beyond financial loss.
The Affiliate Model in the Sentencing
The case illustrates how ransomware-as-a-service divides work. Administrators build and maintain the malware and the infrastructure, while affiliates carry out the intrusions and pay a share of the proceeds. Stryzhak’s 20 percent payment to Nefilim’s administrators is a concrete example of that split.
His move from Nefilim to Hive within about a year shows affiliates are not tied to a single brand. Between 2021 and January 2023 he worked with two groups that both produced large numbers of victims.
What the Timeline Says About Pursuit of Affiliates
The path from the conduct to the sentence is long. The Hive activity ended in January 2023, the arrest came in June 2024, the guilty plea in December 2025 and the sentence in October 2026. Authorities pursued an affiliate who lived in Spain through arrest, extradition and plea.
The 70-month term is the penalty attached to the two conspiracy counts. The FBI’s public statement focused on the scale of the losses and on a healthcare victim rather than on the length of the sentence itself.
Open Questions After the Sentencing
The status of Tymoshchuk is the main outstanding matter. He is indicted and remains a fugitive, so the administrator side of the Nefilim operation has not faced a court. The sentence for Stryzhak does not change that, and no public information indicates when or whether Tymoshchuk will be apprehended.
The sentencing also records details of how the groups worked together. Stryzhak lived in Barcelona during his Nefilim period and was arrested in Spain, so the European location of an affiliate figured in both the offense and the arrest. The FBI’s account of the groups’ impact combines the financial total with the hospital example, and Hive’s reach into 80 countries explains why the case drew in several jurisdictions. The extradition came in April 2026, almost two years after the June 2024 arrest, a measure of how long such proceedings run.
