Conti Ransomware Developer Sentenced to Four Years in U.S. Prison
A Ukrainian national involved in the prolific Conti ransomware group has been sentenced to four years in prison for his role in developing malware and extorting victims.
Oleksii Oleksiyovych Lytvynenko, a 44-year-old Ukrainian national, has been sentenced to four years in federal prison for his extensive involvement with the Conti ransomware group. The Justice Department announced the sentencing on Thursday, detailing Lytvynenko's guilty plea in June to conspiracy to commit wire fraud. He admitted to joining the notorious cybercrime syndicate in September 2021, where he contributed to malware development and directly impacted at least 12 victims, including eight in the United States, by holding their data hostage.
Assistant Attorney General A. Tysen Duva highlighted the widespread damage caused by Conti, stating, "For years, the Conti ransomware group executed a sustained and sophisticated campaign that victimized hundreds of organizations across the United States and abroad, including critical infrastructure entities, causing losses in the millions of dollars." Duva further elaborated on Lytvynenko's specific role, noting he acted as both an "intruder and a developer," personally harming companies and aiding in the creation of the tools used for extortion.
Lytvynenko's arrest occurred in Ireland in July 2023, where he was residing under temporary protective status. Authorities found him asleep with an open laptop running Cobalt Strike software within arm's reach. He was subsequently extradited to the United States in October 2025 to face charges. Prosecutors detailed how Lytvynenko and his co-conspirators extorted approximately $634,000 in Bitcoin from two Tennessee victims, one of which was a government entity that led to the compromise of local law enforcement and emergency services.
Further illustrating the group's ruthlessness, an indictment unsealed last fall revealed that Lytvynenko and his associates leaked stolen data from another Tennessee victim after the organization refused to pay a $3 million ransom demand. The Conti group was one of the most active ransomware operations globally, responsible for attacks on numerous critical infrastructure providers and even the government of Costa Rica in 2022. Its resilience was notable, often re-emerging with new infrastructure after major data leaks exposed internal communications.
Despite Conti officially disbanding in 2022, its members quickly rebranded into successor groups, including Zeon, Black Basta, and Quantum (which later became Royal and then BlackSuit). This continued activity underscores the persistent threat posed by ransomware operators, even after the dissolution of a primary group. Lytvynenko's continued engagement in ransomware operations until his arrest demonstrates the ongoing nature of these criminal enterprises.
FBI Assistant Director of the Cyber Division, Brett Leatherman, emphasized the global reach and consequences of such cybercrimes, stating, "Lytvynenko and his co-conspirators used Conti ransomware to attack computers and networks in nearly every state, and today’s sentence reflects the gravity and extent of those crimes." He issued a stern warning to other cybercriminals, asserting that operating from overseas does not guarantee anonymity or impunity, and that law enforcement will pursue them relentlessly.
The sentencing of Lytvynenko is a significant development in the ongoing efforts to dismantle the infrastructure and prosecute members of major ransomware syndicates. It serves as a stark reminder that individuals involved in such operations, regardless of their specific role or location, can face substantial legal repercussions and lengthy prison sentences in U.S. courts.
This sentencing of Oleksii Lytvynenko, a Ukrainian national, to four years in U.S. prison provides further detail on his specific role within the Conti ransomware operation. Lytvynenko not only acted as a developer for the group but also personally targeted at least a dozen companies and contributed to building malicious tools. Evidence recovered during his arrest indicated his continued involvement in ransomware activities even after Conti's dissolution, and he was extradited from Ireland to face charges.
The sentencing of Oleksii Oleksiyovych Lytvynenko adds further detail to the Conti ransomware operation's downfall. While the existing report notes his four-year sentence, this article specifies his guilty plea to wire fraud in June 2026 and his admission to developing malware and possessing stolen data. It also clarifies his involvement period, stating he joined in September 2021, and notes that investigators believe he continued ransomware activities even after Conti's shutdown until his arrest.
This sentencing adds further detail to the ongoing prosecution of individuals involved in the Conti ransomware operation. The new article specifies that Oleksii Oleksiyovych Lytvynenko, a Ukrainian national, was sentenced to four years in prison for his role in coding a malware loader and handling stolen victim data. It also highlights that evidence recovered from his online accounts linked him to storing and handling exfiltrated information from 12 Conti victims, and that he remained involved in ransomware activities even after the Conti operation officially ended.
The new article provides additional details on Oleksii Lytvynenko's activities, including his use of Cobalt Strike and Rocket.Chat after the Conti group's disbandment. It also specifies that Lytvynenko was extradited from Ireland to the US in October 2025 and details the extent of Conti's attacks across 47 US states and 31 foreign countries, with FBI estimates of victim payouts exceeding $150 million.
The article details Oleksii Lytvynenko's plea agreement, where he admitted to developing malware and stealing data for the Conti operation. It also notes that even after Conti disbanded, Lytvynenko continued engaging in ransomware activities until his arrest, and highlights his prosecution in the U.S. District Court for the Middle District of Tennessee.