Ukrainian National Pleads Guilty to Role in Conti Ransomware Operation
Summary
Oleksii Lytvynenko pleaded guilty to wire-fraud conspiracy tied to Conti attacks in 2021–22. He admitted possessing data from 12 victims and helping code a loader; court documents say Conti targeted over 1,000 victims and collected more than $150 million.
Key points
- Lytvynenko pleaded guilty in the United States to conspiracy to commit wire fraud for his role in Conti ransomware attacks.
- He admitted joining the conspiracy around September 2021 and possessing data from eight U.S. victims and four overseas victims.
- He also admitted working on a loader used to load software for attacks.
- Prosecutors said Conti members deployed ransomware, stole data, and encrypted devices to extort Bitcoin payments.
- Court documents say Conti targeted more than 1,000 victims worldwide and collected over $150 million in ransom payments.
- Lytvynenko was extradited from Ireland after his 2023 arrest and faces a maximum sentence of 20 years.
Article Details
- Event Type
- Guilty plea in a U.S. prosecution connected to the Conti ransomware operation.
- Impact
- Oleksii Oleksiyovych Lytvynenko admitted involvement in Conti attacks between 2021 and 2022, including helping steal data, deploy ransomware, and work on a loader. He possessed data from eight U.S. victims and four overseas victims. Court documents state that Conti targeted more than 1,000 victims and collected over $150 million in ransom payments.
MITRE ATT&CK
People
Threat Actors
ContiRansomware operation whose conspirators, according to prosecutors, deployed ransomware and stole data to extort victims. Court documents state it targeted more than 1,000 victims worldwide.RyukDescribed as a cybercrime group from which the Conti ransomware gang emerged.Trickbot GroupDescribed as a malware syndicate closely tied to the Conti ransomware operation; the article also reports that U.S. and UK authorities sanctioned and charged Russian nationals associated with TrickBot and Conti operations.
Malware
Countries
IrelandHe was extradited from Ireland to the United States after his arrest in 2023.United Kingdomand the United Kingdom also sanctioned and charged nine Russian nationals associated with the TrickBot and Conti ransomware cybercrime operations for attacks against more than 900 victims worldwide.United StatesOleksii Oleksiyovych Lytvynenko pleaded guilty in the United States to conspiracy charges linked to the Conti ransomware operation, which targeted victims worldwide between 2021 and 2022.
Industries
GovernmentThe Conti ransomware operation was one of the most prolific cybercrime groups active at the time, targeting hospitals, businesses, schools, and government agencies worldwide.HealthcareThe group became notorious for large-scale attacks against healthcare organizations, governments, and enterprises before shutting down in 2022, following the leak of its internal chats and increased law enforcement