Stryzhak Gets 70 Months as Early Hive Affiliate in Nefilim Operations

Court filings detail Stryzhak's June 2021 entry into Nefilim under administrator Volodymyr Tymoshchuk, with a 20 percent ransom split. He deployed the malware against an oil and gas transportation firm and later used Hive against seven organizations including a dental practice and healthcare provider. Some victims paid, triggering delivery of decryptors. The record shows he joined Hive as one of its earliest affiliates before the group's 1500-victim run ended in 2023. Extradition from Spain in April 2025 followed a June 2024 arrest in Barcelona. The $10 million bounty on Tymoshchuk and $1 million offers for other operators remain active. Technical evidence from victim decryption keys and payment flows matches patterns seen in prior Hive and Nefilim incidents, confirming direct affiliate access rather than rented access. This case reveals a consistent US strategy of targeting mid-tier affiliates with documented victim impact while core operators remain in jurisdictions resistant to extradition. The 70-month term exceeds many prior affiliate sentences yet leaves the Nefilim infrastructure intact. Procurement records and sealed indictments indicate additional European arrests are queued. Next steps center on whether Spanish and German authorities will accelerate joint operations against remaining Hive remnants ahead of the 2026 statute window for 2021 attacks.