# Nefilim and Hive Ransomware Affiliate Artem Stryzhak Sentenced to 70 Months

> Artem Aleksandrovych Stryzhak, a 36-year-old Ukrainian national and early Hive affiliate who also worked as a Nefilim affiliate, was sentenced on 2026-10-27 to 70 months in prison for ransomware attacks carried out between mid-2018 and late 2021 that affected roughly 1,500 victims worldwide. A US$11 million reward remains open for alleged Nefilim administrator and co-conspirator Volodymyr Tymoshchuk.

- **Published:** 2026-10-27T18:52:04Z
- **Last reviewed:** 2026-10-27T20:55:02.061Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4559
- **ID:** TL-2026-4559
- **Severity:** MEDIUM
- **Category:** RANSOMWARE
- **Status:** MONITORING
- **Actor:** Artem Stryzhak
- **Detections:** 9 · **IOCs:** 26 (full data via the Threadlinqs MCP server — Purple tier)

## Description

This record documents a law-enforcement outcome, not a new exploitation event. Per CyberScoop (2026-10-27), Artem Aleksandrovych Stryzhak was sentenced to 70 months in prison for his role in Nefilim and Hive ransomware attacks conducted from mid-2018 to late 2021. The combined activity affected approximately 1,500 victims in the United States, Canada, Australia, Germany, the Netherlands, Norway and Switzerland (DOJ also lists France for Nefilim). Victims included hospitals where patient care was disrupted, government entities, law firms, oil and gas transportation companies, dental offices, and US engineering consulting, aviation, chemical, insurance, construction, pet care and eyewear companies. Stryzhak was arrested in Spain in June 2024, extradited to the US on 2025-04-30 to face charges in the Eastern District of New York, and pleaded guilty on 2025-12-22 to conspiracy to commit fraud and related activity in connection with computers.

Nefilim operated as an affiliate program. According to DOJ and BleepingComputer, Stryzhak obtained access to the Nefilim ransomware code in June 2021 in exchange for 20 percent of the ransom proceeds he collected, with the remainder going to the administrators. DOJ alleges the Nefilim administrator from July 2020 to October 2021 was Volodymyr Viktorovich Tymoshchuk (aliases deadforz, Boba, msfv, farnetwork), who was also charged for LockerGoga and MegaCortex activity and remains a fugitive. The State Department's Transnational Organized Crime Rewards Program offers up to US$11 million for information leading to his arrest or conviction. Affiliates researched targets using commercial platforms such as ZoomInfo to assess victim revenue (initially companies above US$100 million in annual revenue, later above US$200 million), generated a customized ransomware executable and unique decryption key for each victim network, and threatened to publish stolen data on 'Corporate Leaks' sites if demands were not met.

The sentencing sources do not describe technical TTPs in detail. Supporting technical context comes from vendor and government reporting on the two families. Trend Micro documents Nefilim intrusions that gained access through exposed Citrix and RDP services (including exploitation of Citrix ADC CVE-2019-19781), used AdFind for Active Directory discovery, Cobalt Strike for command and control, Mimikatz for credential theft, 7-Zip to stage data, MEGAsync to exfiltrate it, and PsExec/WMI to push .bat files that stop services and launch the ransomware, with deployment occurring weeks after initial compromise. Nefilim encrypts files with the extensions Nefilim, Nephilim or Off-White. CISA advisory AA22-321A describes Hive as a ransomware-as-a-service operation that, as of November 2022, had victimized over 1,300 companies and received about US$100 million in ransom; it gained access through single-factor RDP/VPN logins, phishing attachments, Microsoft Exchange flaws (CVE-2021-31207, CVE-2021-34473, CVE-2021-34523) and FortiOS CVE-2020-12812, then terminated security and backup processes, deleted shadow copies, cleared Windows event logs, disabled Windows Defender, exfiltrated with Rclone and Mega.nz, and dropped HOW_TO_DECRYPT.txt. No network IOCs (IPs, domains, hashes) are published in the sentencing sources; a BeaconBeagle configuration search for 'nefilim' returned no results. Severity is an analyst judgment, not source-stated. Defenders should treat this as a reminder that Nefilim- and Hive-style intrusions (exposed remote access, credential theft, cloud-sync exfiltration, pre-encryption service and backup disruption) remain relevant even after prosecutions.

## MITRE ATT&CK

- T1591 Gather Victim Org Information
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1078 Valid Accounts
- T1566.001 Spearphishing Attachment
- T1059.003 Windows Command Shell
- T1047 Windows Management Instrumentation
- T1685 Disable or Modify Tools
- T1685.005 Clear Windows Event Logs
- T1003.001 LSASS Memory
- T1087.002 Domain Account
- T1570 Lateral Tool Transfer
- T1560.001 Archive via Utility
- T1567.002 Exfiltration to Cloud Storage
- T1489 Service Stop
- T1490 Inhibit System Recovery
- T1588.001 Obtain Capabilities: Malware
- T1021.001 Remote Services: Remote Desktop Protocol
- T1486 Data Encrypted for Impact
- T1657 Financial Theft

## Sources

- [Prolific Hive and Nefilim ransomware affiliate sentenced to 70 months in prison (CyberScoop)](https://cyberscoop.com/nefilim-hive-ransomware-affiliate-artem-stryzhak-sentenced/)
- [LockerGoga, MegaCortex, and Nefilim Ransomware Administrator Charged (US DOJ)](https://justice.gov/opa/pr/lockergoga-megacortex-and-nefilim-ransomware-administrator-charged-ransomware-attacks)
- [Ukrainian National Pleads Guilty to Conspiracy to Use Ransomware (US DOJ, EDNY)](https://www.justice.gov/usao-edny/pr/ukrainian-national-pleads-guilty-conspiracy-use-ransomware-0)
- [Ukrainian National Extradited from Spain to Face Conspiracy to Use Ransomware Charge (US DOJ, EDNY)](https://www.justice.gov/usao-edny/pr/ukrainian-national-extradited-spain-face-conspiracy-use-ransomware-charge)
- [Ukrainian hacker admits affiliate role in Nefilim ransomware gang (BleepingComputer)](https://www.bleepingcomputer.com/news/security/ukrainian-hacker-admits-affiliate-role-in-nefilim-ransomware-gang/)
- [CISA AA22-321A: #StopRansomware: Hive Ransomware](https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-321a)
- [Updated Analysis on Nefilim Ransomware's Behavior (Trend Micro)](https://www.trendmicro.com/vinfo/de/security/news/cybercrime-and-digital-threats/updated-analysis-on-nefilim-ransomware-s-behavior)
- [Locked, Loaded, and in the Wrong Hands: Legitimate Tools Weaponized for Ransomware in 2021 (Trend Micro)](https://research.trendmicro.com/3hYEMkT)
- [Ukrainian Nefilim Ransomware Affiliate Pleads Guilty in US (SecurityWeek)](https://www.securityweek.com/ukrainian-nefilim-ransomware-affiliate-pleads-guilty-in-us/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4559