When Irish authorities arrested him in July 2023, they found a 44-year-old Ukrainian national asleep and “within arms’ reach of an open laptop running Cobalt Strike.” That arrest set in motion a cross-border prosecution that culminated in a four-year prison sentence this week for his admitted role in Conti’s years-long ransomware campaign.
Arrest in Ireland and extradition to the United States
Officials said the defendant was living in Ireland with temporary protected status when agents took him into custody in July 2023. He was extradited to the United States in October 2025 to face charges unsealed after a grand jury indictment the previous fall. Prosecutors described the physical circumstances of the arrest to underscore the operational links between the suspect and the tools allegedly used in Conti operations.
Guilty plea, identity, and sentence
Oleksii Oleksiyovych Lytvynenko, who has also used the names Alexsey Alexseevich Litvinenko, pleaded guilty in June to conspiracy to commit wire fraud, the Justice Department said. At his plea, he admitted joining Conti in September 2021, developing malware for the group and holding stolen data from 12 victims, including eight based in the United States. This week a federal court sentenced Lytvynenko to four years in prison for his role in those crimes.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildScale of the Conti campaign and its aftermath
Conti was one of the most active ransomware groups globally before it disbanded in 2022, the Justice Department said. The group attacked more than 1,000 organizations worldwide and victimized hundreds of critical infrastructure providers. Conti’s public profile rose further after it impacted Costa Rica’s government in 2022 and when a large leak exposed chats between members later that year. Despite the group’s official disbanding, members reorganized under Cyrillic-language subgroups — named in court records and public reporting as Zeon, Black Basta and Quantum (the latter of which rebranded to Royal and then to BlackSuit in 2024).
Extortion, leaked data, and victims in Tennessee
Prosecutors tied Lytvynenko to specific extortion campaigns in Tennessee. They said he and co‑conspirators extorted about $634,000 in Bitcoin from two Tennessee victims, one described as an undisclosed government entity. That compromise, prosecutors allege, resulted in the intrusion of a sheriff’s department, local emergency medical services and a local police department. An unsealed indictment also alleges Lytvynenko and associates leaked data stolen from another Tennessee-based victim after it refused to pay a $3 million ransom demand.
How the FBI, the Justice Department, and the State Department are responding
- Justice Department: A. Tysen Duva, assistant attorney general of the criminal division, framed the sentencing as accountability for a “sustained and sophisticated campaign” that harmed “hundreds of organizations.” Duva described Lytvynenko as “both an intruder and a developer” who personally harmed at least 12 companies and helped build the tools Conti used to extort and threaten communities.
- FBI: Brett Leatherman, assistant director of the FBI’s cyber division, emphasized that “ransomware criminals should know they are not anonymous and operating from overseas does not mean operating without consequences,” adding that the FBI and partners will “use every lawful tool to dismantle their infrastructure and bring them to justice.”
- State Department: Public reporting cited the State Department’s earlier action in offering a $10 million reward for information related to Conti’s leaders, reflecting a diplomatic and investigative effort aimed at the group’s leadership even as members splintered and rebranded.
The sentence of Lytvynenko is one discrete outcome in a longer, multi-year campaign tracked by prosecutors: alleged intrusions and extortion in multiple U.S. states, the targeting of critical infrastructure and government entities, the use and development of malware by identified individuals, and repeated reconstitution of operations under new names after public exposure. Four alleged co‑conspirators named in the case — Maksim Galochkin, Maksim Rudenskiy, Mikhail Mikhailovich Tsarev and Andrey Yuryevich Zhuykov — were indicted in 2023 in the same federal court for related Conti activity from 2020 to 2022, indicating ongoing legal actions tied to the network.
The immediate effect of this prosecution is concrete: a prison term, extradition after a foreign arrest, and public statements from senior law enforcement officials meant to signal reach and consequences. The longer-running question left by the record is how effectively that legal reach will disrupt the rotating identities and infrastructure that allowed Conti and its offshoots to persist after 2022.
Read the original report: https://cyberscoop.com/conti-ransomware-developer-sentenced/
