Conti Ransomware Gang Member Sentenced to Four Years in Prison

A Ukrainian national has been sentenced to four years in prison for his involvement in attacks using the Conti ransomware. According to the U.S. Department of Justice, 44-year-old Oleksii Oleksiyovych Lytvynenko was arrested by Ireland's national police (An Garda Síochána) in July 2023 at the request of the United States and extradited last year.

Lytvynenko and his accomplices deployed the ransomware on victims' networks in the U.S. and abroad, stealing data and encrypting devices while demanding ransom payments in bitcoin. In June 2026 he pleaded guilty to conspiracy to commit wire fraud — a charge that carried up to 20 years in prison.

His Role in the Scheme

According to Assistant Attorney General A. Thysen Duva, Lytvynenko entered the criminal conspiracy as both a hacker and a developer: he personally caused harm to at least twelve companies, stored data stolen from victims, and helped build the gang's malicious tools. The defendant admitted that he joined the operation in September 2021, controlled the stolen data of eight American and four foreign victims, and sent out ransom demands as part of a double-extortion scheme. In addition, he wrote a so-called “loader” — a piece of malware that delivers to a system the components needed for an attack.

The Scale of Conti

From 2020 to 2022, Conti was used against computers and networks in 47 states, 31 foreign countries, the District of Columbia, and Puerto Rico. According to FBI estimates, by January 2022 victim payments tied to this ransomware had exceeded 150 million dollars; in all, the gang attacked more than a thousand organizations worldwide.

The Conti operation grew out of the Ryuk group in 2020 and was closely tied to the gang behind the TrickBot malware. It became notorious for large-scale attacks on medical facilities, government agencies, and businesses, and later evolved into a full-fledged cybercrime syndicate that controlled, among other things, BazarBackdoor and TrickBot. In 2022, under intensifying pressure from law enforcement and after a leak of internal communications, the operation was wound down, and its members dispersed into other ransomware projects — among them BlackCat, Black Basta, Hive, Quantum, Karakurt, and others.

The investigation around Conti has been going on for years: in February 2023 sanctions were imposed against seven members of TrickBot and Conti, in September of that year the U.S. and the U.K. charged nine Russians, and in May 2025 Germany's Federal Criminal Police Office revealed the identity of the suspected leader — a 36-year-old Russian who operated under the alias “Stern.”

Source: Bleeping Computer