Ukrainian National Sentenced for Conti Ransomware Conspiracy

Washingtontimes

Ukrainian National Sentenced for Conti Ransomware Conspiracy

First seen 11 Sep 2026, 02:15 UTC • •39.0

Article Content

1 / 4

Browse articles

ThreatCluster •September 11, 2026 at 10:48 UTC

•Lytvynenko sentenced to four years for his role in Conti ransomware operations.
•Conti ransomware affected over 1,000 victims, leading to payouts exceeding $150 million.
•The case highlights international cooperation in combating cybercrime.

Oleksii Oleksiyovych Lytvynenko, a 44-year-old Ukrainian national, was sentenced to four years in prison for his role in a wire fraud conspiracy linked to the Conti ransomware variant. This ransomware infected over 1,000 victims globally between 2020 and 2022, impacting 47 U.S. states and 31 countries, with estimated victim payouts exceeding $150 million. Lytvynenko participated as both an intruder and a developer, personally affecting at least 12 companies and continuing ransomware operations after the Conti group disbanded. The Justice Department emphasized the seriousness of ransomware and its commitment to holding cybercriminals accountable, regardless of their location. The case involved extensive collaboration among U.S. law enforcement agencies, including the FBI and the Secret Service.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated just now How this analysis works

Timeline

2020-01-01

Conti ransomware operations began

Conti ransomware was deployed, leading to widespread infections and extortion efforts.

2022-01-01

Victim payouts exceed $150 million

FBI estimates indicated that payouts associated with Conti ransomware surpassed $150 million.

2023-06-10

Lytvynenko pleads guilty

Lytvynenko pleaded guilty to conspiracy to commit wire fraud in connection with the Conti ransomware scheme.

Washington Times

2023-07-01

Lytvynenko arrested

Lytvynenko was arrested in County Cork, Ireland, for his ongoing involvement in ransomware activities.

Washington Times

2026-09-10

Lytvynenko sentenced

Lytvynenko received a four-year prison sentence for his role in the Conti ransomware conspiracy.

More articles in this cluster (3)

Threat Graph

19 entities, 58 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (3)

Ransomware
T1041 - Exfiltration Over C2 Channel
T1486 - Data Encrypted for Impact

Indicator (4)

trickleaks.in
washingtontimes.com
[email protected]
[email protected]

Malware (2)

BazarBackdoor
Trickbot

Threat Actor (10)

Ryuk
Black Basta
Blackbyte
BlackCat
Conti
Hive
Karakurt
Quantum
Silent Ransom Group
Zeon

Relationships

Ryuk uses BazarBackdoor
Ryuk uses Trickbot
Black Basta uses BazarBackdoor
Black Basta uses Trickbot
Blackbyte uses BazarBackdoor
Blackbyte uses Trickbot
BlackCat uses BazarBackdoor
BlackCat uses Trickbot
Conti uses BazarBackdoor
Conti uses Trickbot
Hive uses BazarBackdoor
Hive uses Trickbot
Karakurt uses BazarBackdoor
Karakurt uses Trickbot
Quantum uses BazarBackdoor
Quantum uses Trickbot
Silent Ransom Group uses BazarBackdoor
Silent Ransom Group uses Trickbot
Zeon uses BazarBackdoor
Zeon uses Trickbot
Ryuk uses Ransomware
Ryuk uses T1041 - Exfiltration Over C2 Channel
Ryuk uses T1486 - Data Encrypted for Impact
Black Basta uses Ransomware
Black Basta uses T1041 - Exfiltration Over C2 Channel
Black Basta uses T1486 - Data Encrypted for Impact
Blackbyte uses Ransomware
Blackbyte uses T1041 - Exfiltration Over C2 Channel
Blackbyte uses T1486 - Data Encrypted for Impact
BlackCat uses Ransomware
BlackCat uses T1041 - Exfiltration Over C2 Channel
BlackCat uses T1486 - Data Encrypted for Impact
Conti uses Ransomware
Conti uses T1041 - Exfiltration Over C2 Channel
Conti uses T1486 - Data Encrypted for Impact
Hive uses Ransomware
Hive uses T1041 - Exfiltration Over C2 Channel
Hive uses T1486 - Data Encrypted for Impact
Karakurt uses Ransomware
Karakurt uses T1041 - Exfiltration Over C2 Channel
Karakurt uses T1486 - Data Encrypted for Impact
Quantum uses Ransomware
Quantum uses T1041 - Exfiltration Over C2 Channel
Quantum uses T1486 - Data Encrypted for Impact
Silent Ransom Group uses Ransomware
Silent Ransom Group uses T1041 - Exfiltration Over C2 Channel
Silent Ransom Group uses T1486 - Data Encrypted for Impact
Zeon uses Ransomware
Zeon uses T1041 - Exfiltration Over C2 Channel
Zeon uses T1486 - Data Encrypted for Impact
BazarBackdoor communicates with trickleaks.in
BazarBackdoor communicates with washingtontimes.com
BazarBackdoor communicates with [email protected]
BazarBackdoor communicates with [email protected]
Trickbot communicates with trickleaks.in
Trickbot communicates with washingtontimes.com
Trickbot communicates with [email protected]
Trickbot communicates with [email protected]

Following this threat?

Track Ryuk and BazarBackdoor in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Social Engineering Campaign Hijacks Microsoft 365 Accounts via Passkey Alerts A social engineering campaign impersonating IT support staff is actively hijacking Microsoft 365 accounts. The attackers use passkey-themed lures to trick users into providing credentials, leading to unauthorized access and data exfiltration. Microsoft Security Research has tracked these intrusions since May 2026…

Education Sector Faces Surge in Cyberattacks Amid Open Network Vulnerabilities SonicWall's 2026 Education Protect Brief reveals that educational institutions are experiencing the highest per-device cyberattack intensity of any tracked sector, with 81,879 intrusion prevention system (IPS) hits per device in the first half of 2026. The report highlights that SIPVicious VoIP exploitation accounted…