Ukrainian lawyer's second career as a Conti coder earns him 4 years behind bars
Ukrainian lawyer turned Conti malware coder sentenced to four years in US prison, ordered to forfeit $25,042 in Bitcoin.
Oleksii Oleksiyovych Lytvynenko, 44, a trained lawyer who joined Conti under the handle "henry", pleaded guilty in June to conspiracy to commit wire fraud and was sentenced to four years. He coded a malware loader, researched targets using Google and ZoomInfo, and possessed data stolen from eight US victims who reported over $1.5 million in losses. Investigators found Cobalt Strike running and a Rocket.Chat session over Tor on his laptop when Gardaí arrested him in County Cork, Ireland in July 2023; he was extradited to the US in October 2025. Conti attacked over 1,000 victims across 47 US states and 31 countries, with payouts exceeding $150 million by January 2022.
- Lytvynenko operated under the handle "henry" in a team run by conspirator "silver" or "buza"
- Ordered to forfeit 0.4 BTC worth $25,042 traced back to one of his victims
- Arrested in July 2023 with Cobalt Strike and Rocket.Chat over Tor still active on his laptop
- Conti disbanded in 2022 after internal chats and source code were leaked
- Evidence showed ransomware activity continued after Conti disbanded
- Vendors
- FBIUS Justice Department
- Products
- Cobalt StrikeRocket.ChatZoomInfo
- Threat actors
- Conti
- Malware
- Conti ransomware
- Countries
- UkraineIrelandUnited States
From the original article
2 min read at theregister.comSwapping legal work for malware development ended in extradition and a guilty plea
By Carly Page · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.