Prosecutors believe the cybercriminal began working with Nefilim in or around June 2021, while living in Barcelona, Spain. The Nefilim ransomware-as-a-service (RaaS) operation was known for targeting wealthy companies, with its operators encouraging affiliates to pursue businesses capable of paying substantial ransom demands. One of Nefilim's most high-profile attacks was on Australian logistics giant Toll Group in 2020, encrypting its files around three months after it suffered a separate Mailto ransomware attack.
Court documents [PDF] state that Stryzhak agreed with alleged Nefilim boss Volodymyr Tymoshchuk, who remains at large, to pay the ransomware crew a 20 percent cut of the ransom proceeds he collected. Tymoshchuk told Stryzhak that his preference was for attacks to target companies based in the US, Canada, and Australia that turn over more than $100 million annually. This guidance was soon tweaked to encourage targeting companies in the same regions with more than $200 million in annual revenue.
