A federal court on Oct. 27 sentenced Artem Stryzhak, a 36-year-old Ukrainian national, to 70 months in prison for conspiracy to commit computer fraud. Prosecutors tied him to a run of ransomware attacks against hospitals, government agencies, law firms and other businesses around the world. According to the Justice Department, the FBI says the groups he worked with disrupted patient care and caused more than $100 million in losses.

Stryzhak was not the person who wrote the ransomware. He was an affiliate, a contractor who was given access to the malware and carried out attacks with it, and that role is the main reason his case is worth reading about. Prosecutors described two ransomware brands, Nefilim and Hive, and the case records show how ransomware-as-a-service actually runs: who does what, who gets paid, and how victims are chosen.

The case at a glance

  • Who: Artem Stryzhak, 36, of Ukraine. He lived in Barcelona while working as a Nefilim affiliate, The Record reports.
  • Sentence: 70 months in federal prison, handed down Oct. 27, 2026.
  • Plea: He pleaded guilty in December 2025 to two counts of conspiracy to commit fraud, extortion and related activity in connection with computers, according to the Justice Department and The Record.
  • Timeline: He was arrested in Spain in June 2024 and extradited to the U.S. in April 2025.
  • Still at large: Alleged Nefilim administrator Volodymyr Tymoshchuk. The Justice Department says the State Department is offering a reward of up to $11 million for information on him, and The Record reports a separate $15 million reward for information on other Hive members.

How the affiliate model worked

Ransomware-as-a-service (RaaS) splits the work. A core group builds and maintains the encryption malware, the payment setup and usually a leak site where stolen data is posted. Affiliates sign on to find victims, break in and deploy the malware. Ransom money is then divided between them.

In Stryzhak's case the split is on the record. According to the Justice Department and The Record, he agreed to pay Nefilim's administrators, including the indicted Tymoshchuk, 20% of the ransom proceeds extorted from victims in exchange for access to the Nefilim ransomware. In other words, the core group took a fifth of what the affiliate extorted.

According to CyberScoop, which is reporting on the Justice Department's allegations, the Nefilim crew primarily went after companies in the U.S., Canada and Australia with more than $100 million in annual revenue. After breaking into a network, they researched the company to determine its net worth, size and contact information. Prosecutors say Stryzhak and his co-conspirators customized the ransomware executable for each victim, with a unique decryption key and ransom note, and extorted victims by threatening to publish stolen data.

That last step is called double extortion. The attackers encrypt the victim's files so they cannot be used, and they also threaten to publish data they have taken. A victim that restores everything from backups can still face a second demand: pay, or the stolen files go public.

CyberScoop lists Stryzhak's U.S. victims, which include an aviation company in New York, a chemical company in Ohio, an insurer in Illinois, a construction firm in Texas and a pet care company in Missouri. Prosecutors also said Nefilim ransomware was used to encrypt victim networks in Germany, the Netherlands, Norway and Switzerland. The Record says Stryzhak used Nefilim to attack organizations in the U.S., Canada and Australia throughout 2021.

Moving to Hive

Stryzhak separately joined Hive as one of its earliest affiliates, according to the Justice Department. The Record puts his time with Hive at October 2021 to January 2023. Hive was a prominent ransomware gang; The Record says it encrypted thousands of victims across 80 countries.

The sources give different victim counts, so here is each one with its source. In the DOJ release, U.S. Attorney Gregory W. Kehoe of the Middle District of Florida said the Hive group attacked approximately 1,500 victims worldwide, and the release says Hive conspirators attacked approximately 1,500 victims from June 2021 to January 2023. CyberScoop's summary reads as if about 1,500 victims belong to Nefilim and Hive together, which the DOJ release does not say. The Record says thousands of victims.

The Justice Department says Stryzhak and his co-conspirators deployed Hive against seven victims during the COVID-19 pandemic, including law firms, a dentist office and a healthcare provider. The release also describes a separate Hive attack in which a hospital had to forgo digital technology to treat existing patients and could not immediately accept new patients. The release does not say that hospital was one of Stryzhak's seven victims. It adds that the FBI, during its disruption campaign against Hive, gave a decryption key to one of Stryzhak's victims, who then recovered data without paying.

What prosecutors said

The Justice Department release includes statements from Assistant Attorney General A. Tysen Duva of the Criminal Division, U.S. Attorney Joseph Nocella Jr. of the Eastern District of New York, U.S. Attorney Kehoe and FBI Cyber Branch Operations Director Brett Leatherman. Nocella's statement was aimed at the man still at large: "We remain determined to capture Volodymyr Tymoshchuk."

Leatherman described the combined damage: the groups disrupted patient care and caused more than $100 million in losses.

Stryzhak was arrested in Spain and then extradited to the United States, with help from Spanish law enforcement authorities, according to the Justice Department. Tymoshchuk, by contrast, has evaded capture, The Record reports, and the reward offers are aimed at him and at other Hive members.

What It Means for Defenders

This is a criminal case, not a vulnerability disclosure. None of the sources name a specific CVE, product flaw or patch tied to Stryzhak's intrusions, so there is no single version to upgrade to. The sources do describe how these crews picked targets and applied pressure, and defenders can plan around that.

Who was in the crosshairs. According to CyberScoop, Nefilim primarily targeted companies in the U.S., Canada and Australia with more than $100 million in annual revenue, and its victims spanned ordinary industries: aviation, chemicals, insurance, construction and pet care. Hive's victims included hospitals as well. If your organization is a mid-size or large company in one of those countries, you fit the profile these affiliates were reported to be looking for. Being in an unglamorous industry did not protect anyone.

Plan for theft, not just encryption. Nefilim threatened to publish stolen data, so recovering from backups only deals with half of that threat. Your incident response plan should cover what happens when attackers already hold your data: legal review, breach-notification duties, and how you will communicate with customers and regulators. Watching for large or unusual outbound data transfers matters as much as having backups.

Assume the attacker has read your financials. CyberScoop reports that the crew researched victims' net worth, size and contact information after getting in. Restricting and monitoring access to finance and corporate-profile documents makes that kind of research harder.

Healthcare: test your downtime procedures. The Justice Department describes a hospital that had to forgo digital technology and could not immediately accept new patients after a Hive attack. Clinical teams need practiced manual workflows, and backups for critical systems should be kept separate from the main network, so that ransomware on IT systems does not halt care.

Paying does not end the relationship. The 20% fee shows that a ransom funds both the affiliate and the people running the operation. In the Nefilim case the DOJ says a victim that paid received the decryption key, but nothing in these sources promises that stolen data is deleted after payment.

Federal contractors. If you hold controlled data, treat an affiliate-driven ransomware intrusion as a possible compromise of any such data on the affected systems, and check your contract and regulatory reporting duties with counsel early.

The prosecution does not mean the threat is over. Tymoshchuk is still wanted, and the Justice Department says it will keep working to track down Stryzhak's co-conspirators.

Sources