30
30
30
60
42
55
42
42
55
42
30
Conti Hacker Who Built Malware and Attacked Victims Gets Four-Year Sentence
Ukrainian lawyer and Conti malware developer Oleksii Lytvynenko was sentenced to four years in U.S. prison for wire fraud conspiracy tied to Conti ransomware.
Lytvynenko, 44, admitted coding a loader for Conti and holding stolen data from eight U.S. and four overseas victims; prosecutors linked his actions to attacks on at least 12 companies. Conti infected more than 1,000 organizations across 47 U.S. states and 31 countries between 2020 and 2022, with victim payouts exceeding $150 million. Arrested in County Cork in July 2023 with Cobalt Strike running and an active Rocket.Chat session over Tor, forensic evidence showed his ransomware activity continued after Conti's 2022 collapse.
45
Ukrainian lawyer's second career as a Conti coder earns him 4 years behind bars
Ukrainian lawyer turned Conti malware coder sentenced to four years in US prison, ordered to forfeit $25,042 in Bitcoin.
Oleksii Oleksiyovych Lytvynenko, 44, a trained lawyer who joined Conti under the handle "henry", pleaded guilty in June to conspiracy to commit wire fraud and was sentenced to four years. He coded a malware loader, researched targets using Google and ZoomInfo, and possessed data stolen from eight US victims who reported over $1.5 million in losses. Investigators found Cobalt Strike running and a Rocket.Chat session over Tor on his laptop when Gardaí arrested him in County Cork, Ireland in July 2023; he was extradited to the US in October 2025. Conti attacked over 1,000 victims across 47 US states and 31 countries, with payouts exceeding $150 million by January 2022.
60
Risky Bulletin: Two TeamPCP members arrested in Australia
Australian Federal Police arrested two alleged TeamPCP members behind supply-chain worm attacks that stole over 500,000 credentials from compromised open-source libraries.
The AFP arrested alleged TeamPCP leader Ruben Thomson, 21, and Louis Gaebler, 23, near Perth; both were charged and remain in custody. The group inserted a self-spreading credential-stealing worm into open-source projects including Trivy, KICS, LiteLLM, and Telnyx, harvesting more than 500,000 credentials used for network access, ransomware, extortion, and sales. About 78,000 tokens and secrets from nearly 2,200 organizations leaked online last month, and the FBI supported the investigation that began in April.
74
30
30
55
42
42
60
30
42
30
30