Hive and Nefilim affiliate Stryzhak sentenced to 70 months

Sentence follows a guilty plea

Artem Stryzhak, a Ukrainian national, received a 70-month prison sentence on 27 October 2026 for his participation in ransomware conspiracies involving Nefilim and Hive, according to the US Department of Justice. He had pleaded guilty in December 2025. This is a sentencing development, rather than a newly filed accusation.

DOJ says Stryzhak and his co-conspirators deployed Hive against seven victims, including law firms and healthcare providers. That individual case should be distinguished from the broader damage attributed to the ransomware groups. The announcement does not establish that every loss associated with Hive was caused by this defendant.

How the affiliate arrangement worked

The department describes Stryzhak as an affiliate who gained access to Nefilim's malware and agreed to give its administrators 20% of the ransom proceeds. The arrangement divided the work between people providing the malicious software and those deploying it against victims.

For organisations assessing an extortion incident, identifying the malware operator is therefore only part of the picture. The affiliate's actions, the payment demand and the evidence of data theft need to be read separately. A criminal sentence alone does not show whether a particular victim's files or money have been recovered.

Decryption assistance is separate from compensation

DOJ's current announcement says the FBI supplied a decryption key to one of Stryzhak's victims, enabling recovery of encrypted data without a ransom payment. It does not announce a general compensation programme.

The historical context comes from a separate DOJ notice dated 26 January 2023. It reported that investigators had obtained Hive decryption keys and helped victims avoid $130 million in demanded ransoms. That figure describes payments avoided, not funds returned to victims.

The same notice describes Hive's double-extortion approach: stealing sensitive information before encrypting systems, then demanding payment over both access and possible disclosure. Restoring access to files does not, by itself, establish that stolen copies have been erased.