A Conti developer got four years for holding stolen data from 12 of the group's 1,000-plus victims
Two years of extradition work and a guilty plea produced a four-year sentence for one Conti developer, measured against a group that hit more than 1,000 organizations and reappeared under new names.
The Watch · Security desk
What happened
- The Justice Department said Thursday that Oleksii Oleksiyovych Lytvynenko, 44, a Ukrainian national also known as Alexsey Alexseevich Litvinenko, was sentenced to four years in prison over his role in Conti.
- He pleaded guilty in June to conspiracy to commit wire fraud, having joined the group in September 2021 and written malware for it.
- Irish authorities arrested him in July 2023 at an address where he held temporary protective status, and said he was asleep but within arms' reach of an open laptop running Cobalt Strike.
- Moving him from that arrest into United States custody in October 2025 took about 27 months.
Why it matters
- What it limits constraint The sentence is bounded by what one member can be shown to have kept: the count covers the victims whose stolen data he personally held, so the rest of Conti's victims have no defendant in this case.
- What it sets up precedent A Ukrainian national living in an EU state under temporary protection was handed to a US court, and that route is now demonstrated for the Conti defendants still under indictment abroad.
- Who's exposed exposure Defenders face the same personnel under Zeon, Black Basta and BlackSuit branding, and one developer's conviction leaves those crews' tooling and infrastructure in place.
Next story · Security · 8h ago
Semperis survey puts threats against ransomware victims' staff at 40% of attacksConfirmed2 publishers
The count he pleaded to covers 12 victims whose stolen data he held, eight of them in the United States [6]. Conti hit more than 1,000 organizations before it disbanded in 2022 [3]. Twelve of more than a thousand is at most about 1.2 percent of the reported victim count [20]. Forty-eight months spread across those 12 companies is four months each [21].
The money proved in this case sits in Tennessee. Prosecutors said Lytvynenko and his co-conspirators extorted about $634,000 in Bitcoin from two victims there, one an undisclosed government entity where a sheriff's department, local emergency medical services and a local police department were compromised [13]. A third Tennessee victim refused a $3 million demand and had its stolen data leaked, according to an indictment unsealed last fall [14].
A. Tysen Duva, assistant attorney general of the Justice Department's criminal division, described him as both an intruder and a developer who helped build the tools Conti used to extort [4]. "Even after the Conti conspiracy ended, he continued engaging in active ransomware operations until his arrest," Duva said [2].
"Lytvynenko and his co-conspirators used Conti ransomware to attack computers and networks in nearly every state, and today's sentence reflects the gravity and extent of those crimes," said Brett Leatherman, assistant director of the FBI's cyber division [17]. "Ransomware criminals should know they are not anonymous and operating from overseas does not mean operating without consequences," he added [18].
Conti's run took in hundreds of critical infrastructure providers and the government of Costa Rica in 2022 [11]. After a 2022 leak exposed chats between members, the group rebuilt infrastructure and hit new targets [9]. It disbanded later that year, with members reappearing under Zeon, Black Basta and Quantum, which rebranded to Royal and then to BlackSuit in 2024 [22]. The State Department's $10 million reward is for information on Conti's leaders [19].
Four alleged co-conspirators, Maksim Galochkin, Maksim Rudenskiy, Mikhail Mikhailovich Tsarev and Andrey Yuryevich Zhuykov, were indicted in 2023 in the same federal court over Conti attacks from 2020 to 2022 [10]. Lytvynenko's admitted start date falls in the back half of that window [16]. The account of this sentencing reports no plea, no arrest and no sentence for any of the four, and no other Conti sentence to measure this one against [12].
What to watch
- Any plea, arrest or sentence for Galochkin, Rudenskiy, Tsarev or Zhuykov in the same federal court.
- Whether prosecutors charge BlackSuit-era intrusions to Conti-era personnel, linking the rebrands to existing indictments.
- Whether the State Department's $10 million reward produces information on a named Conti leader.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence70
- Adoption
- Not scored
- Hype gap+20
- Incentives60
- Confidence75
Perspective Coverage
5 publishers- Builder
- Builder 20%
- Operator
- Operator 68%
- Investor
- Investor 12%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Oleksii Oleksiyovych Lytvynenko, also known as Alexsey Alexseevich Litvinenko, a 44-year-old Ukrainian national, was sentenced to four years in prison for his long-running participation in Conti; the Justice Department announced it on a Thursday.
- [2]
"Even after the Conti conspiracy ended, he continued engaging in active ransomware operations until his arrest," said A. Tysen Duva, assistant attorney general of the Justice Department's criminal division.
- [3]
Conti attacked more than 1,000 organizations globally before it disbanded in 2022, the Justice Department said.
- [4]
Duva said Lytvynenko joined the conspiracy as both an intruder and a developer, personally harming at least 12 companies, storing stolen data from victims, and helping build the malicious tools Conti used to extort.
- [5]
Lytvynenko pleaded guilty in June to conspiracy to commit wire fraud.
- [6]
At his plea, Lytvynenko admitted he joined Conti in September 2021, developed malware, and held data on 12 victims, including eight based in the United States.
- [7]
Lytvynenko was arrested in Ireland in July 2023, where he was living with temporary protective status, and authorities said he "was asleep but within arms' reach of an open laptop running Cobalt Strike."
- [8]
Lytvynenko was extradited to the United States in October 2025.
- [9]
Conti bounced back with new infrastructure and hit new targets after a massive leak exposed chats between the group's members in 2022.
- [10]
Four alleged co-conspirators, Maksim Galochkin, Maksim Rudenskiy, Mikhail Mikhailovich Tsarev and Andrey Yuryevich Zhuykov, were indicted in 2023 in the same federal court for crimes related to their suspected involvement in Conti attacks from 2020 to 2022.
- [11]
Conti was among the most active ransomware groups globally, impacting hundreds of critical infrastructure providers and Costa Rica's government in 2022.
- [12]
The report of the sentencing records only an indictment for the four alleged co-conspirators, with no plea, arrest or sentence stated for any of them, and reports no other Conti sentence for comparison.
- [13]
Prosecutors said Lytvynenko and his co-conspirators extorted about $634,000 in Bitcoin from two victims in Tennessee, including an undisclosed government entity, resulting in the compromise of a sheriff's department, local emergency medical services and a local police department.
- [14]
According to an indictment unsealed last fall, Lytvynenko and his co-conspirators leaked data stolen from another Tennessee-based victim after it refused a $3 million ransom demand.
- [15]
About 27 months passed between Lytvynenko's July 2023 arrest in Ireland and his October 2025 extradition to the United States.
- [16]
Lytvynenko's admitted September 2021 start date falls in the back half of the 2020 to 2022 period charged to the four co-conspirators indicted in 2023.
- [17]
"Lytvynenko and his co-conspirators used Conti ransomware to attack computers and networks in nearly every state, and today's sentence reflects the gravity and extent of those crimes," said Brett Leatherman, assistant director of the FBI's cyber division.
- [18]
"Ransomware criminals should know they are not anonymous and operating from overseas does not mean operating without consequences," Leatherman added.
- [19]
The State Department offered a $10 million reward for information related to Conti's leaders.
- [20]
The 12 victims whose data Lytvynenko admitted holding are at most about 1.2 percent of the more than 1,000 organizations Conti attacked.
- [21]
A four-year term is 48 months, or four months for each of the 12 companies whose stolen data Lytvynenko admitted holding.
- [22]
Conti disbanded in 2022, and members of the Cyrillic-language group rebranded under three subgroups: Zeon, Black Basta and Quantum, which quickly rebranded to Royal before rebranding again to BlackSuit in 2024.
Sources
5 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comConti ransomware gang member sentenced to 4 years in prison
2 articles · September 11, 2026
- cyberscoop.comConti ransomware crew member sentenced to four years in prison
2 articles · September 11, 2026
- securityaffairs.comConti Hacker Who Built Malware and Attacked Victims Gets Four-Year Sentence
1 article · September 13, 2026
- securityweek.comUkrainian Conti Ransomware Developer Sentenced to 4 Years in US Prison
1 article · September 11, 2026
- therecord.mediaUkrainian hacker gets four years in US prison over Conti ransomware attacks
1 article · September 11, 2026
Topics and entities
Entities
- Conti
- Oleksii Oleksiyovych Lytvynenko
- U.S. Department of Justice
- Cobalt Strike
- Federal Bureau of Investigation
- Brett Leatherman