Conti Ransomware Operator Sentenced to Four Years in U.S. Prison

Prison term follows arrest and extradition from Ireland

A U.S. court has sentenced Ukrainian national Oleksii Oleksiyovych Lytvynenko to four years in prison for participating in the Conti ransomware operation.

The sentence was reported on September 11, 2026, although the exact sentencing date has not been disclosed. Lytvynenko, 44, pleaded guilty in June 2026 and faced a maximum possible term of 20 years.

Descriptions of the conviction differ slightly. It has been characterized both as wire fraud and as conspiracy to commit wire fraud. The underlying conduct, however, is consistent across the available accounts: Lytvynenko helped compromise companies, controlled stolen information, sent extortion demands and developed malware used in Conti attacks.

Irish national police, An Garda Síochána, arrested him at his home in Cork in July 2023 following a U.S. request. Lytvynenko, who had previously lived in Ireland, spent several years in an Irish jail while contesting extradition.

He was eventually transferred to the United States, with one account placing the extradition in late 2025. The prosecution therefore continued well after Conti had stopped operating under its original name.

Lytvynenko combined malware development with hands-on attacks

Lytvynenko joined the Conti organization in September 2021, according to his guilty plea. Prosecutors did not describe him merely as an affiliate who purchased access or deployed ransomware supplied by others.

His responsibilities reportedly crossed several stages of an intrusion. He worked within a team led by another Conti conspirator, participated in attacks against at least 12 companies and retained stolen data belonging to eight U.S. victims and four victims outside the country.

He also issued ransom notes. Those messages formed the extortion layer of Conti’s business model, pressuring compromised organizations to pay in Bitcoin to recover access and prevent publication of their information.

Lytvynenko additionally wrote code for a malware “loader.” The component has not been identified by a separate name, and no hashes, filenames or other technical indicators have been released.

A loader typically provides an initial execution or delivery mechanism for additional software. In this case, authorities described it as code capable of installing or launching the malware and supporting tools needed to carry out an attack.

That development role is significant. It places Lytvynenko not only at the point of victim contact, but also within the technical infrastructure enabling later payloads to run.

His reported activities included:

• Developing malicious tooling.
• Supporting network intrusions.
• Storing and controlling exfiltrated information.
• Facilitating additional malware execution.
• Participating in ransomware deployment.
• Sending extortion demands to victims.

Evidence recovered by investigators also indicated that his ransomware activity continued after Conti shut down. It is not known when that activity ended or which later operation he allegedly supported. Authorities have not tied him to a specific Conti successor group.

Conti coupled encryption with the threat of a data leak

Conti operated as a double-extortion enterprise. Its personnel entered victim networks, removed sensitive data, encrypted systems and then demanded cryptocurrency payments.

Encryption created immediate operational pressure by disrupting access to files, devices and business services. Data theft provided a second source of leverage: even organizations capable of restoring systems from backups could still be threatened with public disclosure.

The operation targeted more than 1,000 organizations worldwide, including healthcare providers, government bodies, enterprises and critical-infrastructure entities. From 2020 until 2022, attacks reached 47 U.S. states, the District of Columbia, Puerto Rico and 31 foreign countries.

The FBI estimated that Conti-associated victims had paid more than $150 million by January 2022. Other assessments attribute at least that amount to the operation over its active period, but no definitive final proceeds figure has been disclosed.

Lytvynenko’s case represents a smaller, individually attributable portion of that campaign. Prosecutors said he personally harmed at least 12 companies, matching the eight U.S. and four overseas victim datasets reportedly under his control.

The organizations have not been publicly identified. The amount demanded from them, whether any paid, and the nature of the stolen records are also unknown.

Conti’s closure scattered personnel across the ransomware economy

Conti emerged from the Ryuk cybercrime operation in 2020 and maintained close links to the TrickBot malware organization. The broader syndicate was associated with several malicious tools and services, including Conti ransomware, TrickBot and BazarBackdoor.

Its internal organization became more visible following Russia’s full-scale invasion of Ukraine in February 2022. Conti’s leadership publicly supported Moscow, after which an apparent Ukrainian insider released internal conversations and operational records.

The disclosures exposed details about personnel, management practices and attack activity. Combined with law-enforcement pressure, the leaks contributed to Conti’s shutdown in 2022.

The closure did not eliminate its capabilities. Personnel and infrastructure fragmented across the cybercrime ecosystem, with former elements linked broadly to operations including BlackCat, Black Basta, ZEON, Hive, Quantum, BlackByte, Karakurt and Silent Ransom Group.

There is no evidence publicly connecting Lytvynenko to any one of those organizations. Investigators established only that his ransomware involvement persisted after the original Conti operation ended.

That distinction matters because ransomware groups frequently retire brands without ending the underlying criminal activity. Operators can move their access, malware knowledge, negotiation experience and laundering relationships into newly named projects.

Enforcement has continued years after the attacks

Lytvynenko’s prosecution forms part of a wider campaign against the Conti and TrickBot networks.

Seven people associated with TrickBot and Conti were sanctioned in February 2023 after the ContiLeaks and TrickLeaks disclosures exposed internal information. In September 2023, the United States and United Kingdom sanctioned and charged nine Russian nationals associated with attacks against more than 900 victims.

Four other alleged Conti participants were charged in a separate indictment unsealed in September 2023. Ukrainian authorities then arrested another suspected member in Kyiv in 2024.

In May 2025, Germany’s Federal Criminal Police Office, the Bundeskriminalamt, identified alleged TrickBot and Conti leader Vitaly Nikolaevich Kovalev. The 36-year-old Russian was accused of operating under the alias “Stern.”

These actions are separate from Lytvynenko’s case. Public information does not establish that those defendants or sanctioned individuals worked directly with him on the 12 attributed intrusions.

His arrest nevertheless illustrates the long legal exposure facing ransomware personnel. Geographic distance and the retirement of a criminal brand do not necessarily prevent later identification, extradition and prosecution.

Defenders should hunt beyond the encryption event

No victim-specific indicators have been published in connection with the sentencing. There are no malware hashes, domains, IP addresses, filenames, detection rules or vulnerabilities that defenders can use directly.

The case instead highlights behaviors that can appear earlier in the attack chain. Security teams should monitor for unexplained software installation, suspicious child processes and loaders that retrieve or execute secondary payloads.

Controls should also address data theft, not only ransomware encryption. Useful detection points include unusual archive creation, large transfers to external services, unauthorized cloud-storage access and data staging in directories rarely used by legitimate business processes.

Organizations investigating possible Conti-related activity should preserve endpoint telemetry, authentication records, network logs and evidence of extortion communications. Stolen datasets and reused online accounts can connect one operator to several victims or reveal activity continuing under a different group name.

Backups remain necessary for recovery, but they do not neutralize a disclosure threat. Response plans should therefore cover system restoration, legal assessment, data-breach obligations and communication with affected parties.

Where evidence suggests links to Conti, TrickBot, BazarBackdoor or related ransomware activity, victims should consider early coordination with law enforcement. In Lytvynenko’s case, international cooperation between Irish and U.S. authorities turned evidence from a defunct ransomware brand into an arrest, extradition, guilty plea and prison sentence.