Hive ransomware affiliate jailed, years after FBI infiltrated the gang's systems

A Ukrainian man has been sentenced to 70 months in a US prison for his role in a series of ransomware attacks.

36-year-old Artem Stryzhak became an affiliate of the Nefilim ransomware group around June 2021, receiving an 80% cut of the ransoms he managed to extort in attacks against hospitals, government organisations, law firms, and businesses around the world.

The rest of the ransom would go to Nefilim's administrators - including fellow Ukrainian Volodymyr Tymoshchuk, who was charged last year in relation to attacks against hundreds of corporate victims using the LockerGoga and MegaCortex ransomware, as well as Nefilim.

At the time of writing, Tymoshchuk is not in US custody and a US $11 million bounty has been offered by the US State Department for information leading to his arrest.

Nefilim was not the only ransomware gang that Stryzhak worked closely with. He was also an early affiliate of the Hive ransomware-as-a-service (RaaS) operation which targeted businesses and, in particular, organisations working in healthcare.

The FBI later warned that Hive had extorted US $100 million from businesses and organisations globally in a period of just 18 months.

According to the US Department of Justice, Stryzhak and his co-conspirators were behind Hive ransomware attacks against a number of victims, including law firms, a dentist's office, and a healthcare provider, during the COVID-19 pandemic.

Such was the scale of the attacks that in 2022 the US Department of Health and Human Services (HHS) described Hive as an "exceptionally aggressive" threat to the health sector.

In January 2023, it was revealed that a multinational law enforcement operation had secretly penetrated the Hive ransomware operation in late July 2022, capturing decryption keys and quietly passing them to victims so they did not have to pay a ransom.

The DOJ said that the operation saved corporate victims of Hive over US $130 million in ransom payments.

At the time I speculated that the take-down of Hive may lead to the identification and possible apprehension of some of those involved in Hive ransomware attacks. In June 2024, Stryzhak was arrested in Barcelona, and subsequently extradited to the United States where he pleaded guilty.

The infiltration into Hive's infrastructure took place in 2022. Stryzhak was arrested in 2024, and sentenced in 2026. If there's a lesson for ransomware affiliates who think they got away with it, it's that law enforcement is prepared to be patient, and the evidence does not go away.

That's something that Volodymyr Tymoshchuk may also want to consider.