Ransomware

Artem Stryzhak, a 36-year-old Ukrainian who lived in Barcelona, was sentenced in the US on October 27 to 70 months in prison for conspiracy to commit computer fraud. He had pleaded guilty in December 2025 to two conspiracy counts covering his work as an affiliate of two ransomware operations, Nefilim and Hive. Spanish police arrested him in June 2024 and he was extradited in April 2025. The FBI says the groups he worked with caused more than $100 million in losses, a figure for the gangs as a whole, not for his attacks alone.

Volodymyr Tymoshchuk, the Nefilim administrator Stryzhak paid, is charged and at large, and the State Department offers up to $11 million for information leading to his arrest. For defenders, the court record is a useful picture of how an affiliate works: one person renting someone else's ransomware, choosing the victims, getting in, stealing data and then encrypting. The same pattern runs through most ransomware cases today.

How the affiliate model works

In ransomware as a service (RaaS), administrators write the malware, run the infrastructure and handle leak sites, while affiliates do the break-ins. According to the Justice Department, Nefilim's administrators gave Stryzhak access to the ransomware code in June 2021 in exchange for 20% of the ransoms he collected. He worked through an account on the Nefilim "panel", and for each victim the group built a unique ransomware executable, a decryption key and a custom ransom note.

Targeting was deliberate. Administrators preferred companies in the US, Canada and Australia with more than $100 million in annual revenue, and around July 2021 one of them pushed Stryzhak towards companies above $200 million. Once inside a network, he and his co-conspirators looked up the victim in online business databases to learn its size, net worth and who to contact. The ransom notes threatened to publish stolen data on Nefilim's "Corporate Leaks" sites if the company did not pay.

Data theft came first. In June 2021 Stryzhak stole data from a company in the oil and gas transportation industry, and about a week later he created the email addresses that appeared in its ransom note. Trend Micro's analysis of Nefilim intrusions describes the same order: weeks inside the network before encryption, with stolen data used as the main pressure and encryption added on top.

At the same time he was one of Hive's earliest affiliates. Hive hit about 1,500 victims worldwide between June 2021 and January 2023, when an international operation seized its infrastructure. Stryzhak deployed it against seven organisations during the COVID-19 pandemic, including law firms, a dental office and a healthcare provider. The Justice Department says one hospital hit by Hive had to stop using digital systems to treat existing patients and could not take new ones straight away. During a months-long disruption campaign the FBI quietly handed one of Stryzhak's victims a decryption key, so it recovered without paying.

What these intrusions look like on the network

Affiliates bring their own methods, so entry points vary, but the published research on both groups points to the same handful. Trend Micro and The Register reported Nefilim affiliates getting in through exposed or brute-forced Remote Desktop Protocol (RDP) and the Citrix Application Delivery Controller flaw CVE-2019-19781. CISA's Hive advisory, AA22-321A, lists single-factor logins to RDP and VPN, phishing attachments, the FortiOS flaw CVE-2020-12812 (which skips the second factor when the username's letter case is changed) and the Exchange ProxyShell flaws CVE-2021-31207, CVE-2021-34473 and CVE-2021-34523.

Inside, both groups lived off ordinary admin tools. Nefilim affiliates mapped Active Directory with AdFind and BloodHound, took credentials with Mimikatz and LaZagne, and moved with PsExec and WMI, according to Trend Micro. They copied data from file servers to a local folder, packed it with 7-Zip and uploaded it with MEGAsync. CISA says Hive actors likely used Rclone and the Mega.nz cloud service for the same job. Right before encryption, Hive deleted shadow copies, cleared the Windows event logs, switched off Defender through the registry and changed boot settings so the machine could not recover normally.

What to do

These steps follow CISA's #StopRansomware guide and the Hive advisory.

Close the entry points

• List everything reachable from the internet on TCP 3389 (RDP), and every VPN, Citrix and Exchange endpoint. Nothing should offer RDP straight to the internet; put it behind a VPN or a gateway with multi-factor authentication (MFA).
• Require phishing-resistant MFA on VPN, webmail and remote access, and on the accounts that manage backups. On FortiGate, check that user accounts match their LDAP names exactly, since CVE-2020-12812 depends on a case mismatch.
• Confirm Citrix ADC and Exchange are on currently supported, patched builds. A server that was exposed while unpatched in 2021 deserves a compromise check, not only a patch.
• Enforce account lockout and alert on repeated failed logons (Windows Security event 4625) against RDP and VPN accounts.

Watch for data leaving

Affiliates steal before they encrypt, so the exfiltration stage is often the last chance to catch them. Alert on outbound transfers to Mega and other file-sharing services from servers, and on rclone.exe, MEGAsync or a 7-Zip binary appearing on a file server. CISA recommends baselining normal outbound volume and alerting on large departures from it over any port, since tunnelling tools can hide uploads inside HTTPS.

Make backups survive the encryption stage

Hive's playbook, like most, deletes what the attacker can reach: vssadmin.exe delete shadows /all /quiet, wmic.exe shadowcopy delete, bcdedit.exe /set {default} recoveryenabled no. CISA's guide asks for offline, encrypted backups with delete protection or object lock, tested by restoring them, and for backup consoles to sit behind separate credentials with MFA. If a domain admin password can delete your backups, an affiliate holding Mimikatz output can too.

Check whether someone is already in

• Hunt process creation logs (Sysmon event 1 or Windows event 4688) for vssadmin, wbadmin, bcdedit, wevtutil cl and wmic shadowcopy, and treat any hit outside a change window as an incident.
• Look for AdFind, BloodHound collectors, Mimikatz, PsExec services (PSEXESVC) and unexpected remote management software on servers and admin workstations.
• Review new Active Directory accounts and additions to privileged groups (events 4720, 4728, 4732, 4756), and VPN logins from new countries or at odd hours.
• If you find signs of an intrusion, isolate at the switch, preserve memory and disk images, and look for how they got in before restoring. CISA warns that restoring over a live foothold gets you encrypted again.

The wider lesson

This arrest removes one affiliate, and the Nefilim administrator he paid is still free. The defence that holds across groups is the one aimed at the affiliate's steps: no single-factor remote access, early alerts on bulk uploads, and backups that a stolen admin password cannot touch.

Our safeguarding and hardening work closes the remote access and backup gaps described here, and security operations covers the detections for the exfiltration and pre-encryption commands. Open the chat and Yaali, our AI agent, will pass your question to the engineer who would do the work.

---

Sources: US Department of Justice, sentencing, US Department of Justice, guilty plea, The Record, SecurityWeek, The Register, Help Net Security, CISA advisory AA22-321A on Hive, CISA #StopRansomware guide, Trend Micro on Nefilim, The Register on Nefilim research (2021).