Hive and Nefilim Affiliate Gets 70 Months in Prison

Why Did a Hive and Nefilim Ransomware Affiliate Get 70 Months?

Artem Stryzhak's sentence closes a long Hive and Nefilim case, while health and corporate firms keep disclosing breaches from 2026 intrusions.

Published: November 1, 2026 | Last reviewed: November 1, 2026

A federal court sentenced Artem Stryzhak, a 36-year-old Ukrainian national, to 70 months in prison on October 27, 2026 [1]. Prosecutors say he worked as an affiliate of the Nefilim and Hive ransomware operations, which attacked hospitals, government bodies and businesses [1][2]. Separately, health and corporate firms including CareCloud, Quest Diagnostics and Astrana are still disclosing breaches tied to incidents that surfaced between March and October 2026 [5][4][3].

Key takeaways

Stryzhak received 70 months, but the two DOJ releases describe his guilty plea differently.
He paid Nefilim administrators 20 percent of his ransom proceeds in exchange for access to the malware.
DOJ counts about 1,500 Hive victims worldwide between June 2021 and January 2023.
Quest's filing says patient records were accessed. It does not say they were taken.
Astrana's SEC filing describes social engineering and never uses the word ransomware.
CareCloud's HHS count stands at 3,756,469 people.

Conceptual diagram of the affiliate split described in Justice Department court filings. It shows how the roles relate, not a real screen, malware sample or attack.

Artem Stryzhak, 36, was sentenced to 70 months in federal prison on October 27, 2026 [1]. According to the Justice Department, he joined the Nefilim conspiracy around June 2021 after Nefilim administrators gave him access to the ransomware code in exchange for 20 percent of his ransom proceeds [1]. Later he became one of the earliest affiliates of Hive, a separate operation that prosecutors say attacked about 1,500 victims worldwide between June 2021 and January 2023 [1]. Prosecutors tie his Hive work to seven victims, including law firms, a dentist's office and a healthcare provider [1]. The Justice Department says the wider ransomware conspiracies caused more than $100 million in losses [1]. The sentence concludes the years-long investigation into his conduct, but the alleged co-conspirator, Volodymyr Tymoshchuk, remains at large and is covered by a reward of up to $11 million [1]. Court documents describe what happened in these cases; they do not establish how much the victims ultimately paid.

A ransomware affiliate is a person who carries out intrusions and encryption for a ransomware operation in exchange for a share of each ransom. In the Nefilim case, administrators supplied the code and web panel, and affiliates did the work inside victim networks [2]. Affiliates are contractors, so one person can work with several groups.

What did the 70-month sentence actually decide?

The court imposed 70 months, about five years and ten months, for conspiracy to commit computer fraud linked to Nefilim and Hive attacks [1]. The sentence was handed down on October 27, 2026, after a December 2025 guilty plea [1][2]. It came almost six months after the May 6, 2026 sentencing date set at his plea [2].

The Justice Department describes the sentence as concluding a years-long, multi-continent investigation. The two DOJ releases do not agree on the plea, however. The December 2025 release describes one count of conspiracy to commit computer fraud, while the sentencing release describes two counts of conspiracy involving fraud, extortion and related activity.

A few details from the court record are worth keeping straight:

Stryzhak was arrested in Spain in June 2024 and extradited to the United States in April 2025 [1].
The plea release lists a maximum penalty of 10 years, so the 70-month term sits well below that ceiling [2].
As part of the FBI's Hive disruption campaign, one of Stryzhak's victims received a decryption key that let it recover its data without paying a ransom [1].

A prison term does not mean the operation is over. Prosecutors still describe Volodymyr Tymoshchuk as at large, and the State Department offers up to $11 million for information about him [1]. Defenders should read the sentence as evidence that enforcement can reach affiliates years after their attacks, not as a sign that the groups have stopped working.

How did the Nefilim affiliate model work in practice?

Under the affiliate model, an outside operator carries out intrusions and encryption using a criminal group's malware and infrastructure, then shares the proceeds with that group [2]. Stryzhak paid Nefilim administrators 20 percent of the ransom proceeds he collected [2]. The group produced a unique executable, decryption key and ransom note for each victim, and it threatened to publish stolen data if victims refused to pay [2].

Nefilim ran on an arrangement in which administrators supplied the malware and affiliates carried out the attacks. Stryzhak paid the administrators 20 percent of each ransom he collected [2]. Each victim received a tailored executable, a unique decryption key and a custom ransom note, so the payment bought a key rather than a general fix [2]. Extortion ran alongside encryption, and refusal to pay meant the stolen data would be published on sites the administrators maintained [2]. Targets were chosen by revenue, with a preference for companies in the United States, Canada and Australia above $100 million in annual revenue [2]. Court filings describe these mechanics, but they do not say how many victims paid or how much the crew kept. That gap matters for anyone trying to estimate losses from a single filing. Readers should treat headline loss figures as the prosecutors' estimate, not an audited total.

The plea release walks through the operation in some detail:

In June 2021, Nefilim administrators gave Stryzhak access to the ransomware code in exchange for 20 percent of his proceeds [2].
He ran attacks through a web-based Nefilim panel, and he once asked a co-conspirator whether to pick a different username in case federal agents broke into it [2].
Targets were companies in the United States, Canada or Australia with annual revenue above $100 million. The crew researched victims' net worth and contact details after getting inside their networks [2].
A Nefilim administrator later encouraged targeting companies with more than $200 million in annual revenue [2].

This is the double extortion pattern: encryption stops the business, and the threatened leak adds pressure while recovery is still underway. Our guide to preventing double extortion covers the exfiltration side. Court records describe Stryzhak as working with more than one group, which is possible because affiliates are contractors rather than members of a single crew [1].

Which health and corporate breaches are still being disclosed?

Three 2026 filings show how these incidents surface. CareCloud told HHS that 3,756,469 people were affected by an intrusion into one of its Amazon Web Services (AWS) environments in March. Quest Diagnostics told the SEC in October that an unauthorized party accessed certain patient records. Astrana Health reported in September that attackers used social engineering, meaning deception of staff, in attempts to reach its systems.

The three disclosures differ in what they say and how far their investigations have gotten.

Organization	Sector	Where disclosed	What the filing says	Status in this review
CareCloud	Health IT (EHR software)	HHS filing and state notices [5]	Access to one AWS environment, March 10 to 16, 2026; data exfiltrated; 3,756,469 people	Count reported in August 2026
Quest Diagnostics	Clinical laboratory	SEC Form 8-K [4]	Unauthorized access to Quanum LSM; "certain patient records" accessed	Full scope still under investigation
Astrana Health	Health technology	SEC Form 8-K [3]	Social engineering of employees; information "accessed and/or acquired"	Investigation ongoing; no count given

Only CareCloud has a public head count so far [5]. Both Quest and Astrana say their investigations are still running [4][3].

CareCloud's notice says data was exfiltrated, and the exposed information includes Social Security numbers, card data and medical records [5].
Quest's 8-K says patient records were accessed but does not describe data being copied out [4].
Astrana's 8-K says it cannot yet estimate the full impact and intends to notify patients once its review is complete [3].

What does the CareCloud timeline say about disclosure lag?

CareCloud's notice says an unauthorized party accessed one of its AWS environments from March 10 to 16, 2026. The company decided by March 24 to inform the SEC because of how sensitive the affected information was. Its count of 3,756,469 affected people reached the public in August, about five months after the intrusion.

March 10 to 16, 2026: an unauthorized party accessed one AWS environment, and the notice says data was exfiltrated [5].
March 24, 2026: the company decides to inform the SEC because of the sensitivity of the information [5].
August 2026: HHS filings list 3,756,469 people, and notification letters are filed with several state regulators [5].

Timeline built from The Record's reporting on CareCloud's filings and notices. The dates are as reported, and the company's own notice is the primary record.

The coverage also disagrees on how long the attacker stayed. The Record's headline describes a hacker who spent eight hours inside one electronic health record environment, while the notice describes access to an AWS environment across a March 10 to 16 window [5]. Those are different measurements, and a reader should not treat them as the same finding.

How should healthcare and corporate teams act on these disclosures?

Teams should start by checking which vendors and cloud environments hold patient or payment data, and whether they can see access to those systems. Help desks need callback verification, because Astrana's filing says attackers impersonated staff and spoofed a phone number [3]. Teams should also plan for a notification effort that can run for months, as CareCloud's count shows [5].

The practical lessons from this year's health and corporate disclosures are narrow but concrete. Astrana's SEC filing says attackers impersonated company personnel and spoofed the main corporate phone number to reach employees, so callback checks and help-desk verification deserve close review [3]. The company reset affected credentials, restricted remote access tools, restored some systems from clean backups and expanded monitoring and logging [3]. Quest Diagnostics says it learned of unauthorized access to a system clients use for test orders on October 21, and believes certain patient records were accessed [4]. CareCloud's filings show the affected count can grow well after the first alert, reaching 3,756,469 people in federal filings [5]. Each of the three companies disclosed to a regulator before it had a full picture, which means early numbers will move. None of these steps is unusual, so the lesson is about executing them consistently rather than buying new tools. Notification planning should therefore start on day one and assume the count will change.

Review every route into staff accounts, including help desks, remote access tools and phone-based verification. Astrana's filing describes resetting credentials and restricting remote tools, so those are the first things to verify [3]. Our passkey help-desk defenses guide covers the verification side, and our FIDO2 conditional access guide covers phishing-resistant sign-in.
Test restores before you need them. Astrana says it restored some systems from clean backups, which only helps if those backups were checked first [3]. Teams that have not rehearsed the first hour of containment can start with our Active Directory ransomware containment guide.
Confirm that cloud and vendor logs reach back far enough to reconstruct an intrusion. The CareCloud access window ran about one week, so logs need to cover at least that span [5]. Build the notification plan with our data breach notification response plan template.

Conceptual workflow built from the Astrana and Quest SEC filings. It shows stages the filings describe, not an official incident response model.

What remains unresolved?

The open questions involve a co-conspirator still being sought, the scope of two 2026 incidents, and CareCloud's state-level counts. Volodymyr Tymoshchuk remains at large, and the Quest and Astrana investigations are still running [1][3][4]. The Record reports that New Hampshire, Massachusetts and California did not say how many of their residents were affected [5].

Whether any Quest or Astrana data has appeared on a leak site. Neither filing names a group or says that data was posted [3][4].
How many people the Quest and Astrana incidents affect. Neither company has published a count yet [3][4].
When Astrana will notify patients. Its filing says notices will follow once the review is complete [3].

The biggest gap is scope, not whether these incidents happened. A company can confirm access quickly, but confirming what left its systems usually takes longer. Until the filings are updated, any headline count should be read as a floor rather than a final figure.

What do these cases mean for defenders?

Stryzhak's sentence shows that affiliates carry real legal exposure, but it does not change the economics that made the model attractive. Court filings describe a structure in which affiliates did the intrusion work and paid administrators a fixed share of each ransom [2]. That split is why the defensive focus should stay on access and extortion together, not on encryption alone.

The 2026 filings point the same way. Astrana's incident involved social engineering aimed at employees, and Quest's involved unauthorized access to a system that clients use to place test orders and look up results [3][4]. Neither filing describes malware, so the controls that matter most are identity checks, access logging and visibility into who reached a system. For health organizations, the open question is whether staff can recognize an impersonation attempt and whether patient-record systems keep logs long enough to reconstruct an intrusion. For corporate teams, size is no protection, since the Nefilim crew chose targets by revenue and favored larger companies [2].

Enforcement will keep arriving in cases like this one, often years after the attacks. Stryzhak's Nefilim work dates to 2021, and his sentence arrived in late 2026. Teams that wait for a court case to confirm a threat are working from old information, so the more useful habit is keeping logs, evidence and vendor access records current now.

Sources & References

Every figure in this article traces to a numbered source below. Where sources disagree, the article shows the disagreement instead of picking one. We did not run any tests for this article, and nothing here is first-hand testing.