Former Conti Member Pleads Guilty to Wire Fraud Conspiracy
Summary
Former Conti member Oleksii Lytvynenko pleaded guilty to conspiracy to commit wire fraud. Prosecutors say he developed malware used in Conti attacks on more than 1,000 victims; he faces up to 20 years in prison.
Key points
- Lytvynenko admitted joining Conti in September 2021 and pleaded guilty to conspiracy to commit wire fraud.
- He told the court he developed malware used in some Conti attacks, according to officials.
- The Justice Department says Conti attacked more than 1,000 victims across 47 states and about 31 countries; the FBI estimates the group extorted more than $150 million.
- Prosecutors said Lytvynenko and co-conspirators extorted about $634,000 from two Tennessee victims.
- An indictment says the group leaked data stolen from another Tennessee victim after it refused a $3 million ransom demand.
- Lytvynenko was arrested in Ireland in 2023 and extradited to the United States in 2025. He faces up to 20 years in prison, with sentencing scheduled for September 10.
Article Details
- Event Type
- Criminal prosecution: former Conti member Oleksii Oleksiyovych Lytvynenko pleaded guilty to conspiracy to commit wire fraud for his role in Conti ransomware attacks.
- Impact
- The Justice Department says the attacks affected more than 1,000 victims across 47 U.S. states and about 31 countries. The FBI estimates Conti extorted more than $150 million in ransom payments. Prosecutors said Lytvynenko and co-conspirators extorted about $634,000 in Bitcoin from two Tennessee victims; one victim's compromise affected a sheriff's department, emergency medical services, and a police department. Prosecutors also said stolen data from another Tennessee victim was leaked after it refused a $3 million ransom demand.
People
Andrew Tysen DuvaAssistant attorney general of the Justice Department's criminal division; commented publicly on Lytvynenko's guilty plea and the harm attributed to Conti.Brett LeathermanAssistant director of the FBI's cyber division; commented publicly on Lytvynenko's guilty plea and the alleged Conti extortion and data theft.
Threat Actors
Andrey Yuryevich ZhuykovIndicted in 2023 for crimes related to his suspected involvement in Conti attacks from 2020 to 2022, according to the article.ContiRansomware group whose members, including Lytvynenko, were reported to have attacked victims and extorted ransom payments; the group disbanded in 2022.Maksim GalochkinIndicted in 2023 for crimes related to his suspected involvement in Conti attacks from 2020 to 2022, according to the article.Maksim RudenskiyIndicted in 2023 for crimes related to his suspected involvement in Conti attacks from 2020 to 2022, according to the article.Mikhail Mikhailovich TsarevIndicted in 2023 for crimes related to his suspected involvement in Conti attacks from 2020 to 2022, according to the article.Oleksii Oleksiyovych LytvynenkoFormer Conti member who pleaded guilty to conspiracy to commit wire fraud. He admitted joining Conti in September 2021 and told the court he developed malware used in some Conti attacks.
Malware
Tools
Countries
Costa Ricathe most prolific ransomware groups globally, impacting hundreds of critical infrastructure providers, Costa Rica’s government in 2022, and ultimately leading the State Department to offer a $10 million reward forIrelandLytvynenko was arrested in Ireland in July 2023, extradited to the United States in October 2025, and remains in federal custody in Tennessee where at least three of his victims are based.UkraineHe left Ukraine in 2022 and obtained temporary protective status in Ireland, residing in Cork at the time of his arrest.United StatesA former Conti member, Oleksii Oleksiyovych Lytvynenko, pleaded guilty in U.S.
Industries
Critical infrastructureAt one point, Conti was among the most prolific ransomware groups globally, impacting hundreds of critical infrastructure providers, Costa Rica’s government in 2022, and ultimately leading the State Department to offerGovernmentextorted about $634,000 in Bitcoin from two victims in Tennessee, including an undisclosed government entity that resulted in the compromise of a sheriff’s department, local emergency medical services and