Artem Stryzhak was sentenced to 70 months in prison on Tuesday for his role in ransomware extortion connected to the Nefilim and Hive operations. U.S. District Judge Pamela K. Chen imposed the sentence in federal court in Brooklyn, according to the U.S. Attorney’s Office for the Eastern District of New York.
Stryzhak, a Ukrainian national, pleaded guilty in December 2025 to conspiracy to commit fraud, extortion and related activity involving computers. Prosecutors said the conduct involved attacks on computer networks in the United States and other countries.
The sentence follows an international investigation that led to Stryzhak’s arrest in Spain in June 2024. He was extradited to the United States in April 2025, The Record and CyberScoop reported.
What did Artem Stryzhak do for Nefilim?
According to the Justice Department’s account of court documents, Stryzhak joined the Nefilim conspiracy around June 2021 as an affiliate. He received access to the group’s ransomware and agreed to pay its administrators, including alleged administrator Volodymyr Tymoshchuk, 20% of ransom proceeds obtained from victims.
That was the arrangement alleged in this case, not a magic cloud service with a support ticket and a billing portal. The result was more familiar: encrypted or otherwise inaccessible systems, stolen data, and ransom demands.
The Justice Department cited a June 2021 intrusion at an oil-and-gas transportation company in which Stryzhak stole data. About a week later, it said, he created email addresses used in a ransom note sent to the company. Prosecutors said he deployed Nefilim through at least October 2021.
Ransomware is malicious software that blocks access to files, systems or networks while demanding payment, the FBI says. In this case, the Justice Department said victims who paid were given a decryption key intended to unlock files.
How was Stryzhak connected to Hive?
The Justice Department said Stryzhak later became one of Hive’s earliest affiliates. It described Hive conspirators as having attacked about 1,500 victims worldwide between June 2021 and January 2023, including government entities, hospitals and businesses.
That figure describes the wider Hive conspiracy, not attacks assigned solely to Stryzhak. Authorities said the campaign caused serious operational disruption and affected responses during the COVID-19 pandemic. The Record reported that prosecutors described one Hive attack that prevented a hospital from accepting new patients.
There is a timing wrinkle in the public accounts. The Record reported that Stryzhak worked with Hive from October 2021 through January 2023. The Justice Department gives the broader Hive conspiracy period as June 2021 through January 2023, without specifying the precise month Stryzhak personally joined.
Who is Volodymyr Tymoshchuk?
The Justice Department identifies Tymoshchuk as a Nefilim administrator and Stryzhak co-conspirator. He remains sought by U.S. authorities, which are offering up to $11 million for information leading to his arrest or conviction.
The FBI advises ransomware victims to contact a local field office or file a report with the Internet Crime Complaint Center. It also advises organizations to keep systems updated, maintain secure backups and prepare continuity plans. Paying a ransom does not guarantee recovery of data, the bureau says.
This story draws on original reporting from The Record.
