Washington, September 14 — A Ukrainian national who helped build the Conti ransomware strain has been sentenced to four years in federal prison, the U.S. Department of Justice said, closing a chapter on one of the most prolific extortion operations of the early 2020s. Oleksii Oleksiyovych Lytvynenko, 44, formerly of Ireland, pleaded guilty to a single count of conspiracy to commit wire fraud. The DOJ described him as one of Conti’s developers, responsible for coding the ransomware and its delivery system.
He was arrested in Ireland in July 2023, extradited to the United States in 2025, and entered his plea in June 2026. He will serve his sentence in a federal prison.
The scale of the operation
Conti was prolific between 2020 and 2022, claiming over 1,000 victims who paid more than $150 million in ransom. The group attacked schools, local governments and hospitals worldwide, with targets in 47 U.S. states and Puerto Rico. Healthcare was a favoured sector, and the group’s success in holding hospitals to ransom made it a persistent problem for incident responders.
Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division set out Lytvynenko’s role in blunt terms.
“For years, the Conti ransomware group executed a sustained and sophisticated campaign that victimized hundreds of organizations across the U.S. and abroad, including critical infrastructure entities, causing losses in the millions of dollars,” Duva said. “Lytvynenko joined that conspiracy as both an intruder and a developer—personally harming at least 12 companies, storing stolen data from victims, and helping build the malicious tools Conti used to extort and threaten communities.” Duva added that Lytvynenko continued engaging in active ransomware operations even after the Conti conspiracy ended, until his arrest.
“Cybercriminals who build, deploy, or profit from malware like Conti—no matter where they operate, will face justice and meaningful consequences in U.S. courts,” he said.
What the evidence showed, and what it didn’t
Authorities said evidence from Lytvynenko’s online accounts showed he possessed stolen data from the 12 entities, eight of which were located in the U.S. The DOJ did not say how long he was involved in the proliferation of Conti, and given the gang is blamed for hundreds of attacks in 32 countries, his relationship to his conspirators is not entirely clear. Four others have been indicted and all currently face federal criminal charges in Tennessee. Multiple federal agencies participated in the investigation and arrest of the Conti syndicate.
Conti has not been active since 2022. The technical reality of the group’s toolkit — a ransomware payload paired with a delivery system, run by a distributed crew — is precisely what made attribution and prosecution slow.
Lytvynenko’s sentence is the detail that matters for the next crew weighing whether the build is worth the risk. What to watch next is the Tennessee prosecutions. Four defendants remain before the courts, and their cases will test how far U.S. authorities can reach into a ransomware operation whose members were scattered across jurisdictions and whose leadership structure was never fully mapped.
