“From 2020 until 2022, Conti was used to attack computers and networks in 47 states, 31 foreign countries, the District of Columbia, and Puerto Rico,” the Department of Justice said — an accounting that the FBI tied to more than $150,000,000 in estimated victim payouts as of January 2022.
Oleksii Lytvynenko: plea, extradition, and sentence
A Ukrainian national, 44-year-old Oleksii Oleksiyovych Lytvynenko was arrested by the Irish national police (An Garda Síochána) in July 2023 at the request of the United States and “was extradited last year,” the Department of Justice reported. Lytvynenko pleaded guilty to conspiracy to commit wire fraud in June 2026 and faced a statutory maximum sentence of 20 years. A U.S. court sentenced him to four years in prison for his role in Conti ransomware attacks between 2021 and 2022.
His admitted role in Conti’s operations
According to court filings cited by prosecutors, Lytvynenko admitted joining the Conti operation in September 2021. He told authorities he controlled stolen data belonging to eight U.S. victims and four overseas victims and that he sent ransom notes as part of Conti’s double extortion scheme between 2020 and June 2022. Assistant Attorney General A. Tysen Duva summarized the defendant’s conduct: “Lytvynenko joined that conspiracy as both an intruder and a developer — personally harming at least 12 companies, storing stolen data from victims, and helping build the malicious tools Conti used to extort and threaten communities.”
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildTechnical contribution: coding a “loader” and double extortion tactics
Lytvynenko also admitted he joined a team run by another Conti conspirator where he coded a “loader,” a type of malware designed to load the software needed to carry out attacks. Prosecutors said Conti operators deployed ransomware on victim networks, stole data, encrypted devices, and sought Bitcoin ransom payments — frequently combining encryption with threats to publish stolen information, a pattern described in the source material as “double extortion.” The court record ties his coding and administrative activity directly to that operational model.
Conti’s trajectory: origins, affiliates, and splinters
The Conti operation emerged from the Ryuk cybercrime group in 2020 and maintained close ties to the TrickBot malware gang, the DOJ account states. While active, Conti evolved into a syndicate that controlled multiple malware operations, including BazarBackdoor and TrickBot. The group shut down in 2022 after increased law enforcement pressure and leaked internal chats, but it did not disappear: Conti later splintered into other ransomware groups named in the record — BlackCat, Black Basta, ZEON, Hive, Quantum, BlackByte, Karakurt, and the Silent Ransom Group.
Law enforcement actions, doxxing, and sanctions tied to Conti and TrickBot
The DOJ material places Lytvynenko’s conviction against a larger backdrop of multinational enforcement and reputational damage inside the cybercrime networks. Seven TrickBot/Conti members were sanctioned in February 2023 after a massive leak of personal information and internal conversations known as ContiLeaks and TrickLeaks. In September 2023, the United States and the United Kingdom sanctioned and charged nine Russian nationals associated with Conti and TrickBot for attacks against more than 900 victims worldwide. The Federal Criminal Police Office of Germany (Bundeskriminalamt or BKA) later doxed the leader of the TrickBot and Conti cybercrime gangs in May 2025 — identifying him as a 36-year-old Russian named Vitaly Nikolaevich Kovalev, using the alias “Stern,” according to the DOJ summary.
What this means for technologists, policymakers, and affected enterprises
- Technologists and security teams: The record underscores the operational role of bespoke tooling — specifically loaders — and the persistence of double extortion as an extortion technique. Teams defending networks will note the concrete example of contributor-level activity (coding and data control) that prosecutors used in court.
- Policymakers and law enforcement: The account links cross-border arrest, extradition, and multinational sanctions as the enforcement pathway used against Conti and affiliated actors — a pattern that policymakers may point to when evaluating extradition cooperation and sanction strategies.
- Affected enterprises: Prosecutors say Conti operators “stored stolen data from victims” and used ransom notes to extort payments in Bitcoin. For companies that were targeted — and for organizations preparing for possible future campaigns from splinter groups named in the case — those details reinforce the tangible harms prosecutors relied on at sentencing.
The sentence handed to Lytvynenko is one datapoint in a wider mosaic: massive victim counts, a multiyear financial tally, sanctioned members, and splinter groups that inherited techniques and tooling. The Department of Justice’s public account links individual technical contributions — like coding a loader and controlling stolen files — to both corporate harm and coordinated transnational enforcement actions, leaving a clear line of sight from the keyboard to the courtroom.
