Threat actor

Conti

8 mentions in 7 days · 8 in 30 days · 9 total · first seen Aug 12, 2026 · last 3d ago

Timeline9 articles

From Hacks to Bioweapons, Claude Misuse Is Now Everywhere

Anthropic reports Claude was misused by Midnight Blizzard, ShinyHunters, disinformation campaigns, and bioweapon attempts; roundup also covers Xinbi takedown.

Anthropic's new report documents eight months of Claude misuse: Russian state-sponsored hackers (Microsoft-named Midnight Blizzard) used it for reconnaissance against Ukrainian and European government networks, stealing data and maintaining access, while ShinyHunters used it across hacking and extortion campaigns, and users attempted bioweapon development. Anthropic says it disrupted the activity. The WIRED roundup also covers the US seizure and sanctioning of Xinbi Guarantee, a Telegram black market with $30 billion-plus in sales mostly laundering pig-butchering scam proceeds, plus DOJ raids on 13 scam compounds in Madagascar and a four-year prison sentence for a Conti ransomware member. Meta faces scrutiny over AI child abuse ads and a class action over photo harvesting for AI training.

WIRED · SecuritySep 12, 10:30 UTC · 3d agoAI safety & security in the wild 11 sources

Ukrainian National Sentenced to Four Years in Prison for Wire Fraud Conspiracy in Connection with Conti Ransomware

Ukrainian national Oleksii Lytvynenko sentenced to four years for wire fraud conspiracy deploying Conti ransomware that infected over 1,000 computers.

Oleksii Oleksiyovych Lytvynenko, 44, a Ukrainian national, was sentenced to four years in prison for conspiracy to commit wire fraud related to deploying the Conti ransomware variant. The US Department of Justice said the conspiracy infected the computers of more than 1,000 victims. The sentencing is an update to a previously reported case.

DataBreaches.netSep 11, 16:07 UTC · 4d agoPolicy & legal 7 sources

Conti Ransomware Hacker Sentenced After Group Attacked Over 1,000 Victims Worldwide

Ukrainian national Oleksii Lytvynenko sentenced to four years in US prison for his role in Conti ransomware attacks on 1,000+ victims.

Oleksii Oleksiyovych Lytvynenko, 44, pleaded guilty to conspiracy to commit wire fraud for working as a developer and intruder in the Conti ransomware operation, coding a malware loader and handling data stolen from 12 victims. Conti compromised over 1,000 victims across 47 US states and 31 foreign countries between 2020 and 2022, generating more than $150 million in ransoms. He was arrested in County Cork, Ireland in July 2023 and extradited to the US. The sentencing is part of a wider US investigation into the Conti and TrickBot ecosystem.

Cyber Security Newsupdated Sep 11, 16:07 UTC · 4d agofirst Sep 11, 12:31 UTC · 4d agoPolicy & legal 7 sources

Ukrainian lawyer's second career as a Conti coder earns him 4 years behind bars

Ukrainian lawyer turned Conti malware coder sentenced to four years in US prison, ordered to forfeit $25,042 in Bitcoin.

Oleksii Oleksiyovych Lytvynenko, 44, a trained lawyer who joined Conti under the handle "henry", pleaded guilty in June to conspiracy to commit wire fraud and was sentenced to four years. He coded a malware loader, researched targets using Google and ZoomInfo, and possessed data stolen from eight US victims who reported over $1.5 million in losses. Investigators found Cobalt Strike running and a Rocket.Chat session over Tor on his laptop when Gardaí arrested him in County Cork, Ireland in July 2023; he was extradited to the US in October 2025. Conti attacked over 1,000 victims across 47 US states and 31 countries, with payouts exceeding $150 million by January 2022.

The Register · Securityupdated Sep 11, 16:07 UTC · 4d agofirst Sep 11, 12:15 UTC · 4d agoPolicy & legal 7 sources

Ukrainian hacker gets four years in US prison over Conti ransomware attacks

Oleksii Lytvynenko was sentenced to four years in the US for his role in Conti ransomware attacks against 1,000+ victims.

Ukrainian national Oleksii Lytvynenko, 44, was sentenced to four years in a US prison for his role in the Conti ransomware operation, having pleaded guilty in June. He worked as a hacker and developer for Conti, personally targeting at least a dozen companies and building a malware loader, and stolen data from eight US victims and four others overseas was found in his accounts. Between 2020 and 2022, Conti attacked organizations across 47 US states and 31 countries, with the FBI estimating victims paid more than $150 million in ransoms by January 2022. Lytvynenko was arrested in Cork, Ireland in July 2023 and extradited after several years in Irish custody; four other alleged Conti members were charged in a separate September 2023 indictment.

The Recordupdated Sep 11, 16:07 UTC · 4d agofirst Sep 11, 12:00 UTC · 4d agoPolicy & legal 7 sources1

Ukrainian Conti Ransomware Developer Sentenced to 4 Years in US Prison

A US court sentenced Ukrainian Oleksii Lytvynenko to four years in prison for developing malware loaders and handling stolen data for the Conti ransomware operation.

Oleksii Oleksiyovych Lytvynenko, 44, was arrested in Ireland in 2023, extradited to the US in late 2025, and pleaded guilty to wire fraud in June 2026. He admitted joining the Conti gang in September 2021 and helping develop a malware loader, and investigators found victim data in his possession suggesting participation in actual attacks. The Conti operation is estimated to have received at least $150 million in ransoms from victims in more than 30 countries. The sentencing follows recent terms for Karakurt negotiator Deniss Zolotarjovs (8.5 years) and the Ransom Cartel administrator (16 years).

SecurityWeekupdated Sep 11, 16:07 UTC · 4d agofirst Sep 11, 11:29 UTC · 4d agoPolicy & legal 7 sources1

Conti ransomware gang member sentenced to 4 years in prison

US court sentences Ukrainian Conti ransomware member Oleksii Lytvynenko to four years; the gang extorted over $150M from 1,000+ victims.

Ukrainian national Oleksii Oleksiyovych Lytvynenko, 44, was sentenced to four years in prison for his role in Conti ransomware attacks between 2021 and 2022, after being arrested by Irish police in July 2023 and extradited to the US. He pleaded guilty in June 2026 to conspiracy to commit wire fraud, admitting he controlled stolen data from 12 victims and helped develop a loader used in the gang's double extortion attacks. Per the DOJ, Conti attacked more than 1,000 victims across 47 US states and 31 foreign countries, with victim payouts exceeding $150 million as of January 2022. Conti shut down in 2022 and later split into groups including BlackCat, Black Basta, Hive and Quantum.

BleepingComputerupdated Sep 11, 16:07 UTC · 4d agofirst Sep 11, 06:48 UTC · 4d agoPolicy & legal 7 sources1

Conti ransomware crew member sentenced to four years in prison

Ukrainian national Oleksii Lytvynenko sentenced to four years in the US for his role in Conti ransomware attacks on at least 12 companies.

Oleksii Lytvynenko, 44, who pleaded guilty in June to conspiracy to commit wire fraud, was sentenced Thursday to four years in prison by the US Justice Department. He joined the Conti ransomware group in September 2021 as an intruder and malware developer, holding stolen data from 12 victims including eight US-based organizations, and prosecutors said co-conspirators extorted roughly $634,000 in Bitcoin from Tennessee victims including government entities. Conti attacked more than 1,000 organizations before disbanding in 2022, with members rebranding into Zeon, Black Basta, and Quantum/Royal/BlackSuit.

CyberScoopupdated Sep 11, 16:07 UTC · 4d agofirst Sep 10, 20:31 UTC · 5d agoPolicy & legal 7 sources1

Gunra Ransomware Exploits Fortinet FortiOS, FortiProxy Flaws to Breach Networks

CISA, FBI, and South Korean agencies warn Gunra ransomware, with 51 victims since April 2025, exploits Fortinet flaws for double-extortion attacks on critical infrastructure.

CISA, the FBI, and South Korean agencies warned of Gunra ransomware attacks targeting healthcare, financial services, government, and professional services worldwide. The Conti-derived operation exploits internet-facing Fortinet FortiOS and FortiProxy flaws CVE-2024-55591 and CVE-2025-24472 for initial access, then deploys double extortion with Salsa20/ChaCha20 encryption and publishes non-payers on a leak site within five to seven days. Ransomware.Live lists 51 victims since April 2025, mostly in South Korea, Brazil, Spain, Thailand, and Hong Kong. The group uses Impacket tools for SMB lateral movement and NTDS credential dumping, tampers with VDI authentication to accept a designated OTP value to bypass MFA, and launched a RaaS affiliate program in January 2026 under the new alias Golden Community.

The Hacker NewsAug 12, 08:42 UTC · Aug 12, 2026Ransomware in the wildCVE-2024-55591 CVE-2025-24472

Related CVEsby mentions

CVE-2024-555919.898%
Unauthenticated Super-Admin Bypass in Fortinet FortiOS and FortiProxy
CVE-2024-55591 is an authentication bypass (CWE-288) in the Node.js websocket module of Fortinet FortiOS and FortiProxy that lets a remote, unauthenticated attacker gain super-admin privileges via crafted websocket requests. It affects FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12, and is trivially triggerable from the network with no user interaction given network access to the management/websocket interface. Successful exploitation gives full super-admin control of the appliance, which attackers can use to pivot, create persistent access, and deploy ransomware. Any organization running the affected FortiOS or FortiProxy versions, especially with admin interfaces reachable from the internet, is affected. Exploitation is confirmed in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2025-01-14, and multiple ransomware crews (reported as Gunra, SuperBlack, and Mora_001) are actively exploiting it.
· Fortinet FortiOS 7.0.0 through 7.0.16 · Fortinet FortiProxy 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 KEV ransomwarelarge
CVE-2025-244728.17%
Authentication Bypass in Fortinet FortiOS and FortiProxy Grants Super-Admin Access
CVE-2025-24472 is an authentication bypass (CWE-288) in the Fortinet Security Fabric of FortiOS and FortiProxy. A remote, unauthenticated attacker who already knows the serial numbers of both the upstream and downstream devices can send crafted CSF proxy requests to gain super-admin privileges on the downstream device; the attack only works where the Security Fabric is enabled, and the need for serial-number knowledge raises attack complexity. An attacker gains full super-admin control of the downstream Fortinet device, which can serve as a foothold for network-wide compromise. Organizations running affected FortiOS 7.0.x or FortiProxy 7.0.x/7.2.x builds with Security Fabric enabled are in scope. The flaw was added to CISA's KEV catalog on 2025-03-18 with known ransomware use, and multiple ransomware groups (including Gunra, SuperBlack, Mora_001 and Qilin operators) have been reported exploiting Fortinet firewall flaws in recent campaigns.
· Fortinet FortiOS 7.0.0 through 7.0.16 · Fortinet FortiProxy 7.0.0 through 7.0.19 KEV ransomwaremass

Appears with

organization FBI 4 organization US Department of Justice 4 vendor FBI 3 malware Conti ransomware 2 threat actor Black Basta 2 threat actor TrickBot 2 threat actor Ransom Cartel 1 threat actor Midnight Blizzard 1 threat actor BlackSuit 1 threat actor ShinyHunters 1 threat actor Zeon 1 malware Cobalt Strike 1 malware Conti 1 threat actor Karakurt 1 threat actor Ryuk 1 malware Gunra 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.