Conti Ransomware Developer Sentenced to Four Years in Prison
Summary
Oleksii Lytvynenko was sentenced to four years for his role in Conti. Prosecutors said he developed malware, stored stolen victim data and helped extort victims, including two Tennessee organizations.
Key points
- Lytvynenko pleaded guilty to conspiracy to commit wire fraud and received a four-year prison sentence.
- He admitted joining Conti in September 2021, developing malware and holding data from 12 victims, including eight in the United States.
- Prosecutors said Conti members extorted about $634,000 in Bitcoin from two Tennessee victims.
- One Tennessee incident compromised a sheriff’s department, local emergency medical services and a police department, according to prosecutors.
- Lytvynenko was arrested in Ireland in July 2023, extradited to the United States in October 2025, and found near a laptop running Cobalt Strike, authorities said.
- Conti disbanded in 2022; the article says members later operated under successor groups including Zeon, Black Basta, Royal and BlackSuit.
Article Details
- Event Type
- Sentencing of a Conti ransomware group member
- Impact
- Oleksii Oleksiyovych Lytvynenko was sentenced to four years in prison after pleading guilty to conspiracy to commit wire fraud. Prosecutors said Conti attacks affected more than 1,000 organizations worldwide; Lytvynenko helped develop malware, stored data from 12 victims, and participated in extortion that obtained about $634,000 in Bitcoin from two Tennessee victims. One attack compromised a sheriff’s department, local emergency medical services, and a police department.
People
Andrey Yuryevich ZhuykovOne of four alleged Conti co-conspirators indicted in 2023 for crimes related to suspected Conti attacks.Maksim GalochkinOne of four alleged Conti co-conspirators indicted in 2023 for crimes related to suspected Conti attacks.Maksim RudenskiyOne of four alleged Conti co-conspirators indicted in 2023 for crimes related to suspected Conti attacks.Mikhail Mikhailovich TsarevOne of four alleged Conti co-conspirators indicted in 2023 for crimes related to suspected Conti attacks.Oleksii Oleksiyovych LytvynenkoConti member who pleaded guilty to conspiracy to commit wire fraud and was sentenced to four years in prison.
Threat Actors
Andrey Yuryevich ZhuykovAlleged Conti co-conspirator indicted in 2023 for crimes related to suspected attacks from 2020 to 2022.Black BastaNamed in the article as a subgroup formed by former Conti members after Conti disbanded.BlacksuitThe article says Royal rebranded to BlackSuit in 2024.ContiRansomware group responsible for attacks and extortion against organizations worldwide.Maksim GalochkinAlleged Conti co-conspirator indicted in 2023 for crimes related to suspected attacks from 2020 to 2022.Maksim RudenskiyAlleged Conti co-conspirator indicted in 2023 for crimes related to suspected attacks from 2020 to 2022.Mikhail Mikhailovich TsarevAlleged Conti co-conspirator indicted in 2023 for crimes related to suspected attacks from 2020 to 2022.Oleksii Oleksiyovych LytvynenkoConti member who pleaded guilty to conspiracy to commit wire fraud; prosecutors said he developed malware, stored stolen victim data, and participated in extortion.QuantumNamed as a subgroup formed by former Conti members; the article says it quickly rebranded to Royal.RoyalThe article says the subgroup Quantum rebranded to Royal, which later rebranded to BlackSuit.ZeonNamed in the article as a subgroup formed by former Conti members after Conti disbanded.
Malware
Tools
Countries
Costa Ricathe most active ransomware groups globally, impacting hundreds of critical infrastructure providers, Costa Rica’s government in 2022, and ultimately leading the State Department to offer a $10 million reward forIrelandWhen Lytvynenko was arrested in Ireland, where he was living with temporary protective status in July 2023, authorities said he “was asleep but within arms’ reach of an open laptop running Cobalt Strike.” He wasUnited StatesAt that time, he admitted he joined the prolific cybercrime group in September 2021, developed malware and held data on 12 victims, including eight based in the United States.
Industries
Critical infrastructurethat victimized hundreds of organizations across the United States and abroad, including critical infrastructure entities, causing losses in the millions of dollars,” A.Emergency Servicesvictims, including a Tennessee government entity and local emergency services.Governmentvictims, including a Tennessee government entity and local emergency services.