Threat reportRansomwareTL-2026-4559
Nefilim and Hive Ransomware Affiliate Artem Stryzhak Sentenced to 70 Months
Nefilim and Hive Ransomware Affiliate Artem Stryzhak (TL-2026-4559), also tracked as Nefilim ransomware, is a medium-severity ransomware operation, first published 2026-10-27. It is attributed to Artem Stryzhak with high confidence, affects Citrix Application Delivery Controller (CVE-2019-19781, Nefilim, maps to 20 MITRE ATT&CK techniques (T1003.001, T1021.001, T1047), and is covered by 9 detection rules and 26 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 20MITRE ATT&CK
- Actors
- 1Artem Stryzhak
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 26Indicators of compromise
Key facts for TL-2026-4559
- Threat ID
- TL-2026-4559
- Also known as
- Nefilim ransomware, Hive ransomware
- Severity
- MEDIUM
- Status
- MONITORING
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution
- Artem Stryzhak
- Attribution confidence
- HIGH
- Motivation
- FINANCIAL
- Target sectors
- health, government administration, legal, oil-and-gas, engineering, aviation, chemical, insurance, construction, dental
- Target regions
- North America, Europe, australia
- Detection rules
- 9
- Indicators of compromise
- 26
- Updates
- 2026-10-27 · revalidated 1× · latest source
Malware and tooling in Nefilim and Hive Ransomware Affiliate Artem Stryzhak
Malware and tooling: Cobalt Strike, Hive, LockerGoga, MegaCortex, MimiKatz, Nefilim, 7-Zip, AdFind - S0552, Cobalt Strike, MEGAsync, Mimikatz, PSEXEC
How Nefilim and Hive Ransomware Affiliate Artem Stryzhak works
Artem Aleksandrovych Stryzhak, a 36-year-old Ukrainian national and early Hive affiliate who also worked as a Nefilim affiliate, was sentenced on 2026-10-27 to 70 months in prison for ransomware attacks carried out between mid-2018 and late 2021 that affected roughly 1,500 victims worldwide. A US$11 million reward remains open for alleged Nefilim administrator and co-conspirator Volodymyr Tymoshchuk.
This record documents a law-enforcement outcome, not a new exploitation event. Per CyberScoop (2026-10-27), Artem Aleksandrovych Stryzhak was sentenced to 70 months in prison for his role in Nefilim and Hive ransomware attacks conducted from mid-2018 to late 2021. The combined activity affected approximately 1,500 victims in the United States, Canada, Australia, Germany, the Netherlands, Norway and Switzerland (DOJ also lists France for Nefilim). Victims included hospitals where patient care was disrupted, government entities, law firms, oil and gas transportation companies, dental offices, and US engineering consulting, aviation, chemical, insurance, construction, pet care and eyewear companies. Stryzhak was arrested in Spain in June 2024, extradited to the US on 2025-04-30 to face charges in the Eastern District of New York, and pleaded guilty on 2025-12-22 to conspiracy to commit fraud and related activity in connection with computers.
Nefilim operated as an affiliate program. According to DOJ and BleepingComputer, Stryzhak obtained access to the Nefilim ransomware code in June 2021 in exchange for 20 percent of the ransom proceeds he collected, with the remainder going to the administrators. DOJ alleges the Nefilim administrator from July 2020 to October 2021 was Volodymyr Viktorovich Tymoshchuk (aliases deadforz, Boba, msfv, farnetwork), who was also charged for LockerGoga and MegaCortex activity and remains a fugitive. The State Department's Transnational Organized Crime Rewards Program offers up to US$11 million for information leading to his arrest or conviction. Affiliates researched targets using commercial platforms such as ZoomInfo to assess victim revenue (initially companies above US$100 million in annual revenue, later above US$200 million), generated a customized ransomware executable and unique decryption key for each victim network, and threatened to publish stolen data on 'Corporate Leaks' sites if demands were not met.
The sentencing sources do not describe technical TTPs in detail. Supporting technical context comes from vendor and government reporting on the two families. Trend Micro documents Nefilim intrusions that gained access through exposed Citrix and RDP services (including exploitation of Citrix ADC CVE-2019-19781), used AdFind for Active Directory discovery, Cobalt Strike for command and control, Mimikatz for credential theft, 7-Zip to stage data, MEGAsync to exfiltrate it, and PsExec/WMI to push .bat files that stop services and launch the ransomware, with deployment occurring weeks after initial compromise. Nefilim encrypts files with the extensions Nefilim, Nephilim or Off-White. CISA advisory AA22-321A describes Hive as a ransomware-as-a-service operation that, as of November 2022, had victimized over 1,300 companies and received about US$100 million in ransom; it gained access through single-factor RDP/VPN logins, phishing attachments, Microsoft Exchange flaws (CVE-2021-31207, CVE-2021-34473, CVE-2021-34523) and FortiOS CVE-2020-12812, then terminated security and backup processes, deleted shadow copies, cleared Windows event logs, disabled Windows Defender, exfiltrated with Rclone and Mega.nz, and dropped HOW_TO_DECRYPT.txt. No network IOCs (IPs, domains, hashes) are published in the sentencing sources; a BeaconBeagle configuration search for 'nefilim' returned no results. Severity is an analyst judgment, not source-stated. Defenders should treat this as a reminder that Nefilim- and Hive-style intrusions (exposed remote access, credential theft, cloud-sync exfiltration, pre-encryption service and backup disruption) remain relevant even after prosecutions.
MITRE ATT&CK techniques used in TL-2026-4559
Credential Access
Lateral Movement
T1021.001 Remote Services: Remote Desktop Protocol; T1570 Lateral Tool Transfer
Execution
T1047 Windows Management Instrumentation; T1059.003 Windows Command Shell
Initial Access
T1078 Valid Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1566.001 Spearphishing Attachment
Discovery
Impact
T1486 Data Encrypted for Impact; T1489 Service Stop; T1490 Inhibit System Recovery; T1657 Financial Theft
Collection
Exfiltration
T1567.002 Exfiltration to Cloud Storage
Resource Development
T1588.001 Obtain Capabilities: Malware
Reconnaissance
T1591 Gather Victim Org Information
defense-impairment
T1685 Disable or Modify Tools; T1685.005 Clear Windows Event Logs
Affected products and versions in Nefilim and Hive Ransomware Affiliate Artem Stryzhak
Remediation for Nefilim and Hive Ransomware Affiliate Artem Stryzhak
Patches
- Citrix ADC CVE-2019-19781 vendor fix
- Microsoft Exchange fixes for CVE-2021-31207, CVE-2021-34473, CVE-2021-34523
- FortiOS fix for CVE-2020-12812
Immediate actions
- Audit and remove single-factor RDP, VPN and Citrix remote access; require MFA on all external remote services
- Hunt for AdFind, Mimikatz, Cobalt Strike, PsExec, MEGAsync and Rclone execution on servers where they are not sanctioned
- Alert on bulk archive creation (7-Zip) followed by transfers to Mega.nz or other cloud-sync services
- Alert on vssadmin / PowerShell shadow copy deletion, Windows event log clearing and Defender tampering
Workarounds
- Restrict RDP exposure to the internet and gate it behind a VPN with MFA
- Block unsanctioned cloud-sync and file-sharing destinations at egress
Longer-term hardening
- Maintain offline, immutable backups and test restores
- Segment networks and restrict lateral movement via PsExec/WMI and admin shares
- Deploy EDR with behavioral ransomware detection and credential-theft protections
- Patch internet-facing Citrix, Exchange and FortiOS systems promptly
Timeline of Nefilim and Hive Ransomware Affiliate Artem Stryzhak
- Ransomware campaign period begins (December 2018 per DOJ; month precision), spanning LockerGoga, MegaCortex and later Nefilim activity through October 2021
- Volodymyr Tymoshchuk allegedly becomes Nefilim administrator (July 2020; month precision), serving through October 2021
- Stryzhak obtains access to the Nefilim ransomware code in exchange for 20 percent of his ransom proceeds (June 2021; month precision)
- Nefilim administrators encouraged affiliates to target larger companies; revenue threshold initially $100M, later over $200M (month precision).
- Stryzhak's Hive ransomware activity begins, continuing to January 2023 per The Record (month precision).
- Nefilim activity period charged by DOJ ends (October 2021; month precision)
- FBI infiltrates Hive infrastructure, later providing decryption keys to more than 300 victims (month precision).
- Nefilim decryption keys released publicly (September 2022 per DOJ; month precision)
- CISA, FBI and HHS publish AA22-321A on Hive ransomware: over 1,300 victims and about US$100 million in ransom paid
- DOJ announces disruption of Hive and seizure of its Tor payment and leak sites; Hive had targeted over 1,500 victims in 80 countries and collected over $100M.
- Stryzhak arrested in Spain (June 2024; month precision)
- Stryzhak extradited from Spain to the United States to face charges in the Eastern District of New York
- DOJ announces charges against Volodymyr Tymoshchuk as administrator of LockerGoga, MegaCortex and Nefilim; reward of up to US$11 million announced
- Stryzhak pleads guilty to conspiracy to commit fraud and related activity in connection with computers
- Stryzhak sentenced to 70 months in prison for Nefilim and Hive ransomware attacks affecting roughly 1,500 victims
Update history for TL-2026-4559
- 2026-10-27 — Nefilim and Hive ransomware affiliate Artem Stryzhak sentenced to 70 months in prison: What changed No severity, exploitability or status change warranted; the new report is a sentencing write-up with the same outcome. It adds Hive-period and takedown context. New indicators (5) 3 Tymoshchuk aliases (deadforz, msfv, Boba) as
Sources cited for Nefilim and Hive Ransomware Affiliate Artem Stryzhak
- Prolific Hive and Nefilim ransomware affiliate sentenced to 70 months in prison (CyberScoop)
- LockerGoga, MegaCortex, and Nefilim Ransomware Administrator Charged (US DOJ)
- Ukrainian National Pleads Guilty to Conspiracy to Use Ransomware (US DOJ, EDNY)
- Ukrainian National Extradited from Spain to Face Conspiracy to Use Ransomware Charge (US DOJ, EDNY)
- Ukrainian hacker admits affiliate role in Nefilim ransomware gang (BleepingComputer)
- CISA AA22-321A: #StopRansomware: Hive Ransomware
- Updated Analysis on Nefilim Ransomware's Behavior (Trend Micro)
- Locked, Loaded, and in the Wrong Hands: Legitimate Tools Weaponized for Ransomware in 2021 (Trend Micro)
- Ukrainian Nefilim Ransomware Affiliate Pleads Guilty in US (SecurityWeek)
Detection coverage for TL-2026-4559
As of 2026-10-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4559 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.