A Ukrainian national involved in the Conti ransomware operation, Oleksii Oleksiyovych Lytvynenko, has been sentenced to four years in a U.S. federal prison for conspiracy to commit wire fraud. The 44-year-old, formerly residing in Cork, Ireland, pleaded guilty to the charge on June 10, 2026.
Lytvynenko's role in Conti, a ransomware variant that impacted over 1,000 organizations globally, was multifaceted. He was involved in both developing malware tools and directly participating in attacks on victim networks. Specifically, he was tasked with coding a "loader," a type of malicious software designed to facilitate the deployment of other malware on compromised systems.
According to court documents, Lytvynenko conspired with others to deploy Conti ransomware to extort victims and steal their data. From 2020 to 2022, Conti was used to attack computers and networks in 47 U.S. states, 31 foreign countries, the District of Columbia, and Puerto Rico. The FBI estimates that by January 2022, victim payouts associated with Conti ransomware had exceeded $150 million.
Investigators found evidence of Lytvynenko's direct involvement, including stolen data from eight U.S. victims and four overseas organizations recovered from his online accounts. Prosecutors linked his actions to attacks on at least 12 companies, indicating an active role beyond just malware development.
Lytvynenko admitted to joining the Conti group around September 2021 and acknowledged possessing stolen data from multiple victims in the U.S. and abroad.
The Conti operation reportedly ceased in 2022 following a public declaration of support for Russia's invasion of Ukraine, which led to the leak of its internal chat logs and source code. However, Lytvynenko's ransomware activities continued beyond this shutdown.
When Irish police arrested him at his home in County Cork in July 2023, his laptop was reportedly found open, running Cobalt Strike, with an active Rocket.Chat session connected over Tor, suggesting ongoing involvement in cybercrime. Forensic evidence from this arrest further demonstrated his continued ransomware activity.
Lytvynenko was extradited from Ireland to the U.S. in October 2025, more than two years after his arrest. While the charge of conspiracy to commit wire fraud carries a statutory maximum sentence of 20 years, Lytvynenko received a four-year sentence.
Assistant Director Brent Daniels of the U.S. Secret Service’s Office of Field Operations emphasized the significant harm caused by Conti ransomware, which targeted victims across numerous states and countries, disrupting critical operations. Daniels stated that the sentence represents a measure of justice for victims and underscores the Secret Service's commitment to pursuing ransomware actors globally.
This sentencing is part of a broader U.S. effort to combat ransomware. Other recent cases include a 16-year sentence for a Ransom Cartel creator and an 8.5-year sentence for a Karakurt negotiator. In September 2023, four other Conti conspirators were indicted in Tennessee.
