{"id":3974,"date":"2025-12-26T05:40:01","date_gmt":"2025-12-26T05:40:01","guid":{"rendered":"https:\/\/ft365.org\/index.php\/2025\/12\/26\/nefilim-ransomware-affiliate-pleads-guilty\/"},"modified":"2025-12-26T05:40:01","modified_gmt":"2025-12-26T05:40:01","slug":"nefilim-ransomware-affiliate-pleads-guilty","status":"publish","type":"post","link":"http:\/\/ft365.org\/index.php\/2025\/12\/26\/nefilim-ransomware-affiliate-pleads-guilty\/","title":{"rendered":"Nefilim Ransomware Affiliate Pleads Guilty"},"content":{"rendered":"
\n

\"Photo<\/p>\n<\/div>\n

\n

A Ukrainian national has pleaded guilty to using Nefilim ransomware against a number of corporate victims in the US and elsewhere.<\/p>\n

Artem Aleksandrovych Stryzhak, 35, was extradited from the Spanish city of Barcelona earlier this year after being arrested in June 2024. He pleaded guilty to one count of conspiracy to commit computer fraud, according to the US Justice Department (DoJ).<\/p>\n

Stryzhak became a Nefilim affiliate in June 2021, after he was given an account by the ransomware-as-a-service administrators in exchange for 20% of his proceeds.<\/p>\n

Having been encouraged to target companies with $200m+ in annual revenue, Stryzhak and his co-conspirators used online databases like Zoominfo to research and select their victims.<\/p>\n

Organizations in the US, Canada and Australia\u00a0were preferred, with Nefilim working like many variants. The threat actors would compromise networks, steal data and then encrypt it. Victims were told to pay a ransom in exchange for the decryption key, or else have their stolen data published to a \u201ccorporate leaks\u201d site maintained by the ransomware developers.<\/p>\n

Read more on Nefilim: Cyber Agencies Warn of Fast Flux Threat Bypassing Network Defenses<\/em><\/p>\n

It\u2019s unclear how Stryzhak was apprehended but the DoJ explained that, shortly after becoming a Nefilim affiliate, he asked a co\u2011conspirator whether he should choose a different username to the one he used in other criminal activity, in case the panel \u201cgets hacked into by the feds.\u201d<\/p>\n

Nefilim has subsequently been rebranded as Fusion, Milihpen, Gangbang, Nemty and Karma, among other names.<\/p>\n

Stryzhak is facing a maximum of 10 years behind bars and will be sentenced in May 2026.<\/p>\n

Conspirators at Large<\/h2>\n

The guilty plea still leaves at least one of Stryzhak\u2019s co-conspirators at large.<\/p>\n

Volodymyr Tymoshchuk (aka deadforz, Boba, msfv\u00a0and farnetwork), a 28-year-old also from Ukraine, was recently added\u00a0to a list of Europe\u2019s most wanted fugitives\u00a0after being linked to LockerGoga, MegaCortex and Nefilim. He\u2019s believed to have been the administrator of these ransomware groups.<\/p>\n

The US Department of State\u2019s Transnational Organized Crime (TOC) Rewards Program has offered a reward of up to $11m for information\u00a0leading to his location, arrest and\/or conviction.<\/p>\n<\/p><\/div>\n","protected":false},"excerpt":{"rendered":"

A Ukrainian national has pleaded guilty to using Nefilim ransomware against a number of corporate victims in the US and elsewhere. Artem Aleksandrovych Stryzhak, 35, was extradited from the Spanish city of Barcelona earlier this year after being arrested in June 2024. He pleaded guilty to one count of conspiracy to commit computer fraud, according<\/p>\n","protected":false},"author":2,"featured_media":3975,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-3974","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized"],"featured_image_urls":{"full":["http:\/\/ft365.org\/wp-content\/uploads\/2025\/12\/3974-b711fdf6-d1d9-4eaf-8a2b-8ac5399c67dd.jpg",300,300,false],"thumbnail":["http:\/\/ft365.org\/wp-content\/uploads\/2025\/12\/3974-b711fdf6-d1d9-4eaf-8a2b-8ac5399c67dd-150x150.jpg",150,150,true],"medium":["http:\/\/ft365.org\/wp-content\/uploads\/2025\/12\/3974-b711fdf6-d1d9-4eaf-8a2b-8ac5399c67dd.jpg",300,300,false],"medium_large":["http:\/\/ft365.org\/wp-content\/uploads\/2025\/12\/3974-b711fdf6-d1d9-4eaf-8a2b-8ac5399c67dd.jpg",300,300,false],"large":["http:\/\/ft365.org\/wp-content\/uploads\/2025\/12\/3974-b711fdf6-d1d9-4eaf-8a2b-8ac5399c67dd.jpg",300,300,false],"1536x1536":["http:\/\/ft365.org\/wp-content\/uploads\/2025\/12\/3974-b711fdf6-d1d9-4eaf-8a2b-8ac5399c67dd.jpg",300,300,false],"2048x2048":["http:\/\/ft365.org\/wp-content\/uploads\/2025\/12\/3974-b711fdf6-d1d9-4eaf-8a2b-8ac5399c67dd.jpg",300,300,false],"morenews-featured":["http:\/\/ft365.org\/wp-content\/uploads\/2025\/12\/3974-b711fdf6-d1d9-4eaf-8a2b-8ac5399c67dd.jpg",300,300,false],"morenews-large":["http:\/\/ft365.org\/wp-content\/uploads\/2025\/12\/3974-b711fdf6-d1d9-4eaf-8a2b-8ac5399c67dd.jpg",300,300,false],"morenews-medium":["http:\/\/ft365.org\/wp-content\/uploads\/2025\/12\/3974-b711fdf6-d1d9-4eaf-8a2b-8ac5399c67dd.jpg",300,300,false],"crawlomatic_preview_image":["http:\/\/ft365.org\/wp-content\/uploads\/2025\/12\/3974-b711fdf6-d1d9-4eaf-8a2b-8ac5399c67dd-146x146.jpg",146,146,true]},"author_info":{"display_name":"henry","author_link":"http:\/\/ft365.org\/index.php\/author\/henry\/"},"category_info":"Uncategorized<\/a>","tag_info":"Uncategorized","comment_count":"0","_links":{"self":[{"href":"http:\/\/ft365.org\/index.php\/wp-json\/wp\/v2\/posts\/3974","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/ft365.org\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/ft365.org\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/ft365.org\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"http:\/\/ft365.org\/index.php\/wp-json\/wp\/v2\/comments?post=3974"}],"version-history":[{"count":0,"href":"http:\/\/ft365.org\/index.php\/wp-json\/wp\/v2\/posts\/3974\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/ft365.org\/index.php\/wp-json\/wp\/v2\/media\/3975"}],"wp:attachment":[{"href":"http:\/\/ft365.org\/index.php\/wp-json\/wp\/v2\/media?parent=3974"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/ft365.org\/index.php\/wp-json\/wp\/v2\/categories?post=3974"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/ft365.org\/index.php\/wp-json\/wp\/v2\/tags?post=3974"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}