A Ukrainian national has received a four-year prison sentence for his role in Conti ransomware attacks. The cybercrime operation targeted organizations in the United States and other countries between 2020 and 2022.
Oleksii Oleksiyovych Lytvynenko, 44, worked as both a network intruder and malware developer. He personally helped attack at least 12 companies and stored information stolen from victims.
The Conti ransomware member also developed malicious tools and sent ransom notes during double-extortion attacks.
Lytvynenko Extradited From Ireland
Irish national police arrested Lytvynenko in July 2023 following a request from the United States. Authorities then extradited him to the U.S. in 2025.
In June 2026, he pleaded guilty to conspiracy to commit wire fraud. The charge carried a maximum sentence of 20 years in prison.
Lytvynenko admitted that he joined the Conti operation in September 2021. However, his involvement in related double-extortion attacks covered activity between 2020 and June 2022.
During that period, the gang entered victim networks, stole information and encrypted devices. It then demanded Bitcoin payments in exchange for decrypting files and withholding the stolen data.
Defendant Helped Attack 12 Companies
Court records show that Lytvynenko controlled stolen data belonging to eight victims in the United States. He also held information taken from four companies in other countries.
Additionally, he sent ransom notes to victims on behalf of the Conti gang. These messages threatened organizations with permanent data loss and the public release of stolen information.
The Department of Justice said Lytvynenko personally harmed at least 12 companies. Moreover, he helped create tools that Conti used to compromise and extort communities.
His work extended beyond handling stolen files. The Conti ransomware member joined a team led by another conspirator and developed a malware loader.
A loader prepares compromised systems for later stages of an attack. For example, it can download or launch additional malicious software after attackers gain initial access.
Conti Collected More Than $150 Million
The Conti ransomware operation attacked systems across 47 U.S. states, the District of Columbia and Puerto Rico. It also struck victims in 31 foreign countries.
According to the FBI, known victim payments linked to Conti had exceeded $150 million by January 2022. Court documents indicate that the group targeted more than 1,000 victims worldwide during its active years.
Healthcare providers, government agencies and major businesses were among its most prominent targets. Consequently, the gang became one of the most damaging ransomware operations of its time.
Conti combined data theft with file encryption to increase pressure on victims. If an organization refused to pay, the attackers could publish confidential information on a leak site.
Conti Emerged From the Ryuk Operation
Conti appeared in 2020 as a successor to the Ryuk cybercrime group. It also maintained close connections to the operators behind TrickBot malware.
Over time, Conti grew into a wider cybercrime syndicate. The organization controlled several malicious operations, including TrickBot and BazarBackdoor.
However, the group faced greater scrutiny after declaring support for Russia following its invasion of Ukraine. Soon afterward, an unknown person leaked internal conversations and other sensitive information from the operation.
The disclosures, known as ContiLeaks, exposed the gang’s internal structure and communications. Meanwhile, law enforcement agencies increased their efforts against its members.
Conti eventually shut down its public operation in 2022. Nevertheless, many of its members reportedly moved into smaller ransomware and extortion groups.
Former Members Joined Other Ransomware Gangs
Conti’s breakup did not end the threat posed by its experienced operators. Former members reportedly moved into groups such as BlackCat, Black Basta, ZEON, Hive and Quantum.
Other linked operations included BlackByte, Karakurt and the Silent Ransom Group. Therefore, the shutdown largely divided the syndicate into smaller units instead of removing its members from cybercrime.
Authorities in several countries have continued targeting people connected to Conti and TrickBot. The United States and United Kingdom sanctioned seven members in February 2023.
Later that year, both countries sanctioned and charged nine Russian nationals associated with the two operations. Officials linked those individuals to attacks against more than 900 victims worldwide.
In May 2025, Germany’s Federal Criminal Police Office identified the alleged leader of the TrickBot and Conti groups. German authorities named him as Russian national Vitaly Nikolaevich Kovalev, who allegedly used the alias “Stern.”
Lytvynenko’s four-year sentence marks another law enforcement action against the dismantled syndicate. Still, the movement of former members into other groups means Conti’s influence continues across the ransomware landscape.
0 responses to “Conti Ransomware Member Sentenced to Four Years in Prison”