Hive and Nefilim Ransomware Affiliate Artem Stryzhak Sentenced to 70 Months in Prison

On October 27, a US court sentenced Artem Stryzhak to 70 months in prison for his role in ransomware crimes. A federal court in Brooklyn handed down the sentence. It marks a new stage in the case over earlier attacks carried out with the Nefilim and Hive ransomware.

What the case is about

According to the US Department of Justice, Stryzhak worked as an affiliate of ransomware groups. He got access to their criminal tools and used them against victims. He pleaded guilty in December 2025.

On the Nefilim side, the findings include stealing data from a company in the oil and gas transportation sector and demanding a ransom. On the Hive side, prosecutors described attacks on seven organizations, including law firms, a dental practice and a healthcare provider.

The Department of Justice noted that the Hive operation as a whole hit about 1,500 victims worldwide. That figure is not the number of attacks attributed to Stryzhak himself. The distinction matters when judging how large a part he played in the group’s activity.

Stryzhak was arrested in Spain in June 2024 and later extradited to the United States. The sentence closes a criminal case. It does not end the threat posed by other ransomware operators.

Lessons for businesses

The case shows that one ransomware attack can combine data theft, encryption and pressure on business continuity. That is why incident preparedness needs to go beyond simply restoring files.

• Verify that critical services can be restored from backups kept separate from the production environment.
• Limit administrative privileges and remote access to what is actually needed.
• Make sure you retain the event logs needed to reconstruct how an intrusion happened.
• Set rules for preserving evidence and for working with investigators.
• Rehearse decisions about business downtime and communication with affected parties.

These are organizational recommendations. The sentencing announcement does not identify a single intrusion method common to all of the victims described.

SecurHUB commentary

Being ready for ransomware takes both technical safeguards and operational decisions that have already been rehearsed. Our security incident response service covers incident analysis and support in organizing the response after a breach is detected.

Sources: US Department of Justice, CyberScoop