Ukrainian National Sentenced to Four Years in Prison for Conti Ransomware Conspiracy

Arrest, Extradition and Guilty Plea

An Garda Síochána arrested Lytvynenko in Ireland in July 2023 at the request of United States authorities. He was extradited and pleaded guilty to conspiracy to commit wire fraud. The charge carried a maximum penalty of twenty years in prison.

Prosecutors stated he joined the Conti operation in September 2021 as both an intrusion specialist and a developer. He admitted controlling stolen data from eight United States victims and four overseas victims, sending ransom demands and working on a malware loader for another conspirator.

Activities Inside the Conti Gang

Lytvynenko performed network intrusions, exfiltrated files and sent ransom notes as part of the gang's double extortion model between September 2021 and June 2022. Court records state he handled data from at least twelve companies during that period.

He also joined a development team and wrote a loader, a type of malware designed to load the software needed to carry out attacks. This dual function made him both an attacker and a tool builder for other gang members.

Scale and Financial Toll of Conti Attacks

The Department of Justice stated that Conti ransomware attacked computers and networks in forty-seven states, thirty-one foreign countries, the District of Columbia and Puerto Rico between 2020 and 2022. The FBI estimated that victim payouts associated with Conti ransomware exceeded $150 million by January 2022.

Court documents indicate Conti targeted more than 1,000 victims worldwide during its operation. Assistant Attorney General A. Tysen Duva stated that Lytvynenko personally harmed at least twelve companies, stored stolen data from victims and helped build the malicious tools Conti used to extort and threaten communities.

Emergence and Collapse of Conti

The Conti ransomware operation emerged from the Ryuk cybercrime group in 2020 with close ties to the TrickBot malware gang. Conti evolved into a syndicate that controlled multiple malware operations, including BazarBackdoor and TrickBot.

Conti shut down in 2022 after increased law enforcement pressure and leaked internal chats. According to the source report, former Conti operators splintered into several successor ransomware operations.

Law Enforcement Actions Against Members

Seven TrickBot and Conti members were sanctioned in February 2023 after a massive leak of personal information and internal conversations known as the ContiLeaks and TrickLeaks. In September 2023, the United States and the United Kingdom sanctioned and charged nine Russian nationals associated with Conti and TrickBot for attacks against over 900 victims worldwide.

The Federal Criminal Police Office of Germany publicly identified the leader of the TrickBot and Conti operations in May 2025 as a Russian individual using the alias Stern, according to the source report.

Steps Organizations Can Take Against Ransomware Loaders

Deploy endpoint detection and response tools that monitor for unsigned executables and unusual processes. Segment networks to limit lateral movement if an intrusion occurs. Enforce multi-factor authentication on all remote access to reduce the risk of credential compromise. Maintain offline backups that cannot be encrypted by attackers. Filter email attachments and links to reduce phishing success. Train staff to recognize social engineering attempts that deliver initial payloads.

1. Deploy endpoint detection and response tools that monitor for unsigned executables and unusual processes.
2. Segment networks to limit lateral movement if an intrusion occurs.
3. Enforce multi-factor authentication on all remote access to reduce the risk of credential compromise.
4. Maintain offline backups that cannot be encrypted by attackers.
5. Filter email attachments and links to reduce phishing success.
6. Train staff to recognize social engineering attempts that deliver initial payloads.

Questions readers ask

Source and reporting limits

Based on reporting by BleepingComputer. This automated brief is not independent verification. Claims are attributed to the reporting source; later developments may change the picture.