Ukrainian Conti ransomware developer Oleksii Lytvynenko sentenced to four years in US prison

Ukrainian national Oleksii Oleksiyovych Lytvynenko, 44, has been sentenced to four years in a US prison for conspiracy to commit wire fraud for his intruder and malware-developer role in Conti ransomware attacks on 1,000+ victims; he was also ordered to…

Oleksii Oleksiyovych Lytvynenko, a 44-year-old Ukrainian national, was sentenced to four years in a US prison (reported September 10-11, 2026) after pleading guilty in June 2026 to conspiracy to commit wire fraud for his role in the Conti ransomware operation; SecurityWeek notes the charge carried a maximum of 20 years. The Justice Department announced the sentencing in a press release, describing a conspiracy that deployed the Conti ransomware variant and infected the computers of more than 1,000 victims (DataBreaches.net). Lytvynenko was also ordered to forfeit 0.4 BTC worth $25,042, traced back to one of his victims (The Register). A trained lawyer by profession, Lytvynenko operated in Conti under the handle 'henry' in a team run by conspirators known as 'silver' or 'buza' (The Register). He admitted joining the gang in September 2021 as an intruder and malware developer: he coded a malware loader used in Conti's double-extortion attacks - deploying ransomware payloads and establishing persistence (Cyber Security News) - and researched targets using Google and ZoomInfo (The Register). He controlled stolen data from 12 victims - 8 US-based and 4 overseas - which The Record says was recovered from his online accounts; The Register reports the 8 US victims reported over $1.5 million in losses. SecurityWeek says he remained involved in ransomware attacks until his 2023 arrest. He was arrested by Irish police (Gardai) in County Cork, Ireland, in July 2023 at the US request, reportedly with Cobalt Strike running and a Rocket.Chat session over Tor still active on his laptop, and was extradited to the US in October 2025 (CyberScoop, The Register; SecurityWeek says late 2025) after several years in Irish custody. Conti attacked more than 1,000 victims across 47 US states and 31 foreign countries between 2020 and 2022 (SecurityWeek says more than 30 countries; BleepingComputer places Lytvynenko's own attacks between 2021 and 2022), with victim payments exceeding $150 million by January 2022 - attributed to the DOJ by BleepingComputer and described as an FBI estimate by The Record and Cyber Security News. Conti hit hundreds of critical infrastructure organizations, including healthcare, schools and local governments, as well as Costa Rica's government, prompting a $10 million State Department reward (CyberScoop). Prosecutors said co-conspirators extorted roughly $634,000 in Bitcoin from two Tennessee victims, including government entities - a compromise…

• Oleksii Oleksiyovych Lytvynenko, 44, a Ukrainian national, was sentenced to four years in a US prison (reported September 10-11, 2026) for conspiracy to commit wire fraud; he pleaded guilty in June 2026, and the charge carried a maximum of…
• The US Department of Justice announced the sentencing in a press release, describing a conspiracy that deployed Conti ransomware and infected the computers of more than 1,000 victims (DataBreaches.net).
• Lytvynenko, a trained lawyer, operated in Conti under the handle 'henry' in a team run by conspirators known as 'silver' or 'buza' (The Register); he joined the gang in September 2021 as an intruder and malware developer.
• He coded a malware loader used in Conti's double-extortion attacks - deploying ransomware payloads and establishing persistence (Cyber Security News) - and researched targets using Google and ZoomInfo (The Register).
• He controlled stolen data from 12 victims - 8 US-based and 4 overseas - recovered from his online accounts (The Record); the 8 US victims reported over $1.5 million in losses (The Register).
• He was ordered to forfeit 0.4 BTC worth $25,042, traced back to one of his victims (The Register).
• He was arrested by Gardai in County Cork, Ireland, in July 2023 at the US request, with Cobalt Strike running and a Rocket.Chat session over Tor active on his laptop, and extradited to the US in October 2025 (CyberScoop, The Register;…
• Conti attacked more than 1,000 victims across 47 US states and 31 foreign countries between 2020 and 2022 (SecurityWeek: more than 30 countries; BleepingComputer places Lytvynenko's attacks between 2021 and 2022).