A Ukrainian national, Oleksii Oleksiyovych Lytvynenko, 44, has been sentenced to four years in prison for his involvement with the Conti ransomware group. Lytvynenko, also known as Alexsey Alexseevich Litvinenko, pleaded guilty in June to conspiracy to commit wire fraud.
The Department of Justice confirmed Lytvynenko joined the cybercrime group in September 2021, where he developed malware and stored stolen data from at least 12 victim companies, eight of which were based in the United States. He continued to engage in active ransomware operations even after Conti officially disbanded.
Lytvynenko was arrested in Ireland in July 2023, where he was found with an open laptop running Cobalt Strike. He was extradited to the United States in October 2025.
Prosecutors stated that Lytvynenko and his co-conspirators extorted approximately $634,000 in Bitcoin from two victims in Tennessee. One of these victims was an undisclosed government entity, leading to the compromise of a sheriff’s department, local emergency medical services, and a local police department. In another instance, Lytvynenko and his associates leaked data stolen from a Tennessee-based victim after the victim refused to pay a $3 million ransom demand.
An indictment unsealed last fall also named four alleged co-conspirators: Maksim Galochkin, Maksim Rudenskiy, Mikhail Mikhailovich Tsarev, and Andrey Yuryevich Zhuykov. These individuals were indicted in 2023 in the same federal court for their suspected involvement in Conti attacks between 2020 and 2022.
Conti was a highly active ransomware group, responsible for attacks on over 1,000 organizations globally, including critical infrastructure providers and the government of Costa Rica in 2022. The group caused millions of dollars in losses before it disbanded in 2022.
Despite its disbandment, members of the Cyrillic-language group reportedly rebranded into subgroups such as Zeon, Black Basta, and Quantum, which later rebranded to Royal, and then to BlackSuit in 2024. The State Department had previously offered a $10 million reward for information related to Conti’s leaders.
The FBI noted that Lytvynenko and his co-conspirators used Conti ransomware to attack computers and networks in nearly every U.S. state. The sentencing underscores the commitment of U.S. authorities to pursue cybercriminals regardless of their location.
