Ukrainian Conti Ransomware Member Gets Four Years for Extorting 12 Companies

Key points

• Oleksii Oleksiyovych Lytvynenko, 44, a Ukrainian national, was sentenced this week to four years in a US federal prison for his role in the Conti ransomware gang.
• He admitted joining Conti in September 2021 and personally harming at least 12 companies, eight in the US and four abroad.
• The FBI estimates Conti victims paid out more than $150 million by January 2022, hitting targets in 47 US states and 31 countries.
• Lytvynenko was arrested in Ireland by the Irish national police in July 2023 and extradited to the US last year.
• Conti shut down in 2022 after its internal chats leaked, but members regrouped into gangs including Black Basta, Hive, Karakurt, and the Silent Ransom Group.

A US federal court has sentenced a Ukrainian man to four years in prison for helping run one of the most damaging ransomware operations of the last decade.

Oleksii Oleksiyovych Lytvynenko, 44, admitted joining the Conti gang in September 2021. Ransomware is malicious software that locks a company's files until a payment is made, usually in Bitcoin. Conti went further and stole the files first, then threatened to publish them if the victim refused to pay. Security researchers call that tactic double extortion, a subject we've tracked since our first coverage on 22 July 2026.

He pleaded guilty to conspiracy to commit wire fraud in June 2026, facing up to 20 years.

What did he actually do?

Prosecutors say Lytvynenko worked as both an intruder and a developer inside Conti, personally harming at least 12 companies. He retained stolen files from eight US victims and four foreign ones, and sent the ransom notes demanding payment.

He also wrote code for a loader, a small piece of malware whose only job is to quietly pull down the bigger attack tools onto a victim's network once the criminals are inside.

Assistant Attorney General A. Tysen Duva said Lytvynenko joined the conspiracy "as both an intruder and a developer," helping build the tools Conti used to "extort and threaten communities."

How big was Conti?

Enormous. The FBI estimates victims had paid more than $150 million in ransoms by January 2022. Court documents put the total victim count above 1,000 worldwide.

Conti grew out of the Ryuk crew in 2020, a lineage we followed in our July report on the Ryuk guilty plea, and worked closely with the TrickBot malware gang. It became notorious for attacks on hospitals, government enterprises, and critical infrastructure. The group publicly backed Russia's invasion of Ukraine in early 2022, which pushed an insider to leak the gang's internal chats. Those leaks, dubbed ContiLeaks, helped investigators put names to aliases. Conti formally shut down later that year, but its members scattered into other ransomware brands including BlackCat, ZEON, Hive, Quantum, BlackByte, Karakurt, and the Silent Ransom Group, several of which are still active.

Is anyone else being prosecuted?

Yes. Seven TrickBot and Conti members were sanctioned in February 2023, and another nine Russian nationals were sanctioned and charged in September 2023 over attacks on more than 900 victims. Germany's Bundeskriminalamt named the alleged leader of TrickBot and Conti in May 2025 as 36-year-old Russian Vitaly Nikolaevich Kovalev, alias "Stern."

Should you worry?

If your organisation was hit by Conti between 2020 and 2022, assume the stolen files are still circulating. Regulators including the FTC in the US and the ICO in the UK still expect breach notifications for historical incidents where new evidence emerges. Rotate any credentials that were stored on compromised systems, even years later. Criminals sell old data sets for a long time, and a guilty plea in 2026 counts as new evidence.