A US court has sentenced Ukrainian national Oleksii Lytvynenko to four years in prison for his role in the Conti ransomware operation. The group attacked hundreds of organisations worldwide and collected more than $150 million from victims, according to the FBI.
Prosecutors said Lytvynenko worked as both a hacker and developer. He stole victim data, deployed ransomware and helped create tools used to extort businesses.
Lytvynenko Targeted at Least 12 Companies
The 44-year-old Conti ransomware operator participated in attacks against at least 12 companies. According to the US Department of Justice, he helped steal confidential information and develop tools for the group’s extortion campaigns.
Lytvynenko continued participating in ransomware operations after Conti began dismantling its infrastructure in 2022. Authorities eventually arrested him in Cork, Ireland, in July 2023.
He then spent several years in Ireland while challenging his extradition to the United States. However, the legal process ultimately transferred him to US custody.
On June 10, 2026, Lytvynenko pleaded guilty to conspiracy to commit wire fraud and deploying Conti ransomware. A US court later sentenced him to four years in federal prison.
Conti Attacked Critical Organisations Worldwide
Conti operated from 2020 until 2022 and became one of the world’s most prolific ransomware groups. Its affiliates targeted hospitals, schools, businesses and local government agencies.
Security researchers have identified at least 859 Conti victims across 31 countries. Moreover, the group frequently targeted critical infrastructure organisations in the United States and abroad.
The attackers encrypted computer systems and stole sensitive files from compromised networks. They then demanded payment to restore access and prevent the publication of the stolen information.
According to the FBI, victims paid Conti more than $150 million in ransom demands. However, the overall financial damage was likely much higher because organisations also faced operational disruption and recovery expenses.
Internal Leak Helped Bring Down Conti
Conti’s decline began after the group publicly supported Russia’s invasion of Ukraine. The announcement created divisions among members, some of whom opposed the group’s position.
Soon afterwards, an individual using the name ContiLeaks published a large collection of internal material. The leak exposed private conversations, technical manuals, infrastructure details, malware source code and hacking tools.
Consequently, the disclosures revealed how Conti organised its operations and managed affiliates. They also gave cybersecurity researchers valuable information about the group’s methods and infrastructure.
Conti eventually dismantled its public operation. Nevertheless, several members reportedly moved to smaller ransomware groups, including BlackCat, also known as ALPHV, and Hive.
US Officials Promise Further Action
The Justice Department said the Conti ransomware operator contributed to a sustained global campaign that caused millions of dollars in losses.
US officials also warned that individuals who create, deploy or profit from ransomware can face prosecution in American courts. Lytvynenko’s sentence demonstrates that authorities continue pursuing former Conti members years after the group’s collapse.
While Conti no longer operates under its original name, its members and techniques continue to influence the ransomware landscape. Therefore, international investigations into the group and its former affiliates are likely to continue.
0 responses to “Conti Ransomware Operator Sentenced to Four Years in Prison”