Serial ransomware crook gets 70 months behind bars for Nefilim, Hive roles

Ukrainian ransomware crook Artem Stryzhak has been sentenced to 70 months in the slammer by a New York federal court for his role as an affiliate of the Nefilim and Hive ransomware gangs.

Prosecutors believe the cybercriminal began working with Nefilim in or around June 2021, while living in Barcelona, Spain.

The Nefilim ransomware-as-a-service (RaaS) operation was known for targeting wealthy companies, with its operators encouraging affiliates to pursue businesses capable of paying substantial ransom demands.

One of Nefilim's most high-profile attacks was on Australian logistics giant Toll Group in 2020, encrypting its files roughly three months after it suffered a separate Mailto ransomware attack.

Court documents [PDF] state that Stryzhak agreed with alleged Nefilim boss Volodymyr Tymoshchuk, who remains at large, to pay the ransomware crew a 20 percent cut of the ransom proceeds he collected.

Tymoshchuk told Stryzhak that his preference was for attacks to target companies based in the US, Canada, and Australia that turn over more …