Do Son 
TL;DR
A US court sentenced Hive ransomware affiliate Artem Stryzhak to 70 months in prison. He pleaded guilty to two counts of computer fraud conspiracy tied to Hive and Nefilim ransomware. His charged co-conspirator, Volodymyr Tymoshchuk, remains at large with an $11 million reward on offer.
What happened
According to court documents, Stryzhak joined Nefilim ransomware as an affiliate in June 2021. He agreed to pay the group’s administrators 20% of ransom proceeds. Separately, he became one of Hive’s earliest affiliates and deployed it against seven victims, including a healthcare provider.
Spanish police arrested him in June 2024. He was extradited in April 2025 and pleaded guilty in December 2025.
Who is behind it
Stryzhak now stands convicted. Tymoshchuk, an alleged Nefilim administrator, is charged but not convicted. US Attorney Joseph Nocella Jr. said, “We remain determined to capture Volodymyr Tymoshchuk.”
Impact and scale
From June 2021 to January 2023, Hive attacked about 1,500 victims, according to the DOJ. The FBI’s Brett Leatherman said the groups “disrupted patient care and caused more than $100 million in losses.”
What comes next
The State Department offers up to $11 million for information on Tymoshchuk. Tips can go to the FBI at TymoTips@fbi.gov or to the nearest US Embassy.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
