A Ukrainian cybercriminal linked to the Hive and Nefilim ransomware operations has been sentenced to five years and ten months in a U.S. prison.
Artem Stryzhak, 36, participated in attacks targeting businesses, law firms, and healthcare organizations, including victims affected during the COVID-19 pandemic.
His conviction marks another development in the international investigation into ransomware groups responsible for disrupting organizations worldwide.
But the case is far from over.
U.S. authorities are offering a reward of up to $11 million for information about another alleged participant, Volodymyr Tymoshchuk.
How the hive ransomware hacker operated
According to U.S. court documents, Stryzhak joined the Nefilim ransomware operation as an affiliate around June 2021.
Nefilim used a business model commonly known as Ransomware as a Service, or RaaS.
Instead of conducting every attack themselves, ransomware operators provided malicious software to affiliates who carried out intrusions and extortion attempts.
In return, the operators received a share of the proceeds.
Stryzhak agreed to pay Nefilim administrators 20% of the ransom payments collected from victims.
It’s a revenue-sharing arrangement that resembles a legitimate business partnership, except the underlying activity involves stolen data, encrypted systems, and criminal extortion.
During a June 2021 attack, Stryzhak stole information from a company operating in the oil and gas transportation industry.
His involvement with Nefilim continued until at least October 2021.
Nefilim focused on high-revenue companies
Nefilim’s targeting strategy was particularly revealing. The group preferred organizations based in the United States, Canada, and Australia, especially companies generating more than $100 million in annual revenue.
In July 2021, one of the operation’s administrators encouraged Stryzhak to focus on businesses with annual revenue exceeding $200 million.
The objective was straightforward: target organizations with greater financial resources and potentially demand larger ransom payments.
This approach reflects how ransomware operations have evolved into financially motivated criminal enterprises.
Rather than attacking randomly, some groups evaluate a potential victim’s financial profile before deciding whether an intrusion is worth pursuing.
Hive ransomware targeted healthcare during COVID-19
Stryzhak also became one of the earliest affiliates of the Hive ransomware group.
Investigators linked him and his co-conspirators to attacks against seven victims, including law firms, a dental office, and a healthcare provider.
Some of these incidents occurred during the COVID-19 pandemic, when healthcare organizations were already dealing with exceptional operational pressure.
For a healthcare provider, ransomware can create consequences extending far beyond financial losses.
Losing access to critical systems may disrupt patient records, scheduling, internal communications, and medical operations.
In one case, the FBI provided a decryption key to a victim, allowing the organization to recover its encrypted information without paying the attackers.
The wider Hive operation was responsible for attacks against approximately 1,500 victims worldwide between June 2021 and January 2023.
That figure illustrates the scale of the criminal network beyond the attacks directly attributed to Stryzhak.
From arrest in Spain to a U.S. prison sentence
Stryzhak was arrested in Spain in June 2024 and extradited to the United States in April 2025.
In December 2025, he pleaded guilty to two conspiracy charges involving fraud, extortion, and computer-related criminal activity.
He was subsequently sentenced to five years and ten months in prison.
The case demonstrates how international cooperation can help authorities identify and prosecute individuals involved in ransomware operations.
However, bringing one affiliate to justice doesn’t necessarily mean the entire criminal network has been dismantled.
Investigators are still pursuing other alleged participants.
U.S. offers $11 million reward for another suspect
The U.S. Department of State has announced a reward of up to $11 million for information leading to the location, arrest, or conviction of Volodymyr Tymoshchuk.
Authorities have identified Tymoshchuk as an alleged co-conspirator in the ransomware investigation.
The substantial reward highlights the importance U.S. officials place on pursuing individuals connected to international cybercrime operations.
Ransomware networks often involve participants operating across national borders, complicating investigations and prosecutions.
Even after criminal infrastructure is disrupted, the search for its operators and affiliates can continue for years.
What the case reveals about modern ransomware
The Stryzhak case highlights a fundamental characteristic of today’s ransomware ecosystem. The people deploying malicious software aren’t always the same individuals who develop it.
Affiliate programs allow criminal organizations to distribute responsibilities, expand their operations, and share profits from successful attacks.
This structure makes ransomware particularly difficult to combat.
Disrupting a single malware family isn’t enough. Investigators must also identify the people, infrastructure, financial networks, and partnerships supporting the operation. For organizations, the lesson is equally important.
Reliable backups, multifactor authentication, timely security updates, restricted privileges, and tested incident response procedures can help reduce the likelihood and impact of ransomware attacks. A prison sentence may bring accountability for past attacks.
But for businesses and healthcare providers, preventing the next intrusion remains the priority.
