Loading story…
Ukrainian national Oleksii Oleksiyovych Lytvynenko received a four-year U.S. prison sentence after pleading guilty to conspiring to commit wire fraud through the Conti ransomware operation. Lytvynenko joined Conti in September 2021, developed malware, and possessed data stolen from 12 victims, including eight U.S. organizations. Prosecutors said he and his co-conspirators extorted about $634,000 in Bitcoin from two Tennessee victims; one intrusion disrupted a sheriff’s department, emergency medical services, and a police department.
The sentence follows broader U.S. prosecutions targeting the interconnected Trickbot and Conti ecosystems. Justice Department indictments allege that operators used Trickbot—an infostealer that infected millions of systems worldwide—to obtain access for Conti ransomware attacks against hospitals, schools, businesses, local governments, and public-safety agencies. Conti compromised more than 900 organizations globally before it disbanded in 2022, with former personnel subsequently linked to successor operations including Zeon, Black Basta, and the Quantum/Royal/BlackSuit lineage.
TTPs, infrastructure, and targeting history in one profile.
15 events from the most recent confirmed update back to the earliest known activity.
The United States extradited Lytvynenko from Ireland to face charges related to his alleged Conti ransomware activity.
Ukrainian authorities arrested another suspected member of the Conti ransomware operation in Kyiv.
The Quantum ransomware lineage, which had previously rebranded as Royal, rebranded as BlackSuit after former Conti members moved into successor groups.
The Justice Department unsealed three federal indictments charging Russian nationals over alleged Trickbot and Conti roles. The Conti case charged Galochkin, Maksim Rudenskiy, Mikhail Tsarev, and Andrey Zhuykov for an alleged conspiracy operating through June 2022.
Irish authorities arrested Lytvynenko while he was living in Ireland under temporary protective status; he was reportedly near an open laptop running Cobalt Strike at the time.
Trickbot developer Alla Witte pleaded guilty to conspiracy to commit computer fraud and was sentenced to 32 months in prison.
Conti disbanded after attacking more than 1,000 organizations globally, including critical-infrastructure providers and the Costa Rican government.
Trickbot, which allegedly infected millions of computers and was used as an initial-access vector for ransomware including Conti, was taken down.
A leak exposed chats between Conti members, although the group subsequently resumed operations using new infrastructure and targets.
Oleksii Oleksiyovych Lytvynenko admitted that he joined the Conti cybercrime group and developed malware for the operation.
Maksim Galochkin was later charged over a Conti ransomware attack on Scripps Health that allegedly impaired medical examination, diagnosis, treatment, and care.
The Middle District of Tennessee indictment alleges that Conti conspirators conducted ransomware operations against hundreds of victims, including hospital systems and governments, from 2020 through June 2022.
According to the Northern District of Ohio indictment, the defendants began conspiring to use Trickbot malware to steal money and sensitive information from victims worldwide.
A U.S. court sentenced Lytvynenko to four years in prison for participating in the Conti ransomware conspiracy. Prosecutors said he and co-conspirators extorted about $634,000 in Bitcoin from two Tennessee victims.
Lytvynenko pleaded guilty to conspiracy to commit wire fraud for his participation in the Conti ransomware conspiracy.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
12 references tracked. Mallory keeps watching after this page renders.
hipaajournal.com
Open sourcecysecurity.news
Open sourcesecurityaffairs.com
Open sourcemalware.news
Open sourcesecurityweek.com
Open sourcecyberscoop.com
Open sourcejustice.gov
Open sourcejustice.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ukrainian national **Oleksii Oleksiyovych Lytvynenko** pleaded guilty in U.S. federal court to **conspiracy to commit wire fraud** for his role in the **Conti** ransomware operation, one of the most prolific cybercrime campaigns tracked by U.S. authorities. Prosecutors said Lytvynenko joined Conti by September 2021, helped develop a malware loader used to gain initial access to victim networks, and possessed data stolen from 12 victims, including eight in the United States. He was arrested in Ireland in July 2023, extradited to the United States in October 2025, and now faces up to **20 years in prison**, with sentencing scheduled for September 2026. The Justice Department said Conti targeted more than **1,000 victims** across **47 U.S. states**, Puerto Rico, Washington, D.C., and about **31 countries**, extorting more than **$150 million** in ransom payments. In one part of the case, prosecutors said Lytvynenko and co-conspirators collected about **$634,000 in Bitcoin** from two Tennessee victims and leaked stolen data from another Tennessee organization after a **$3 million** ransom demand was rejected. The plea comes as U.S. authorities continue pursuing other alleged Conti members; earlier indictments also tied the group’s breakup to successor operations including **Black Basta**, **Quantum**, **Royal**, and **BlackSuit**.
Jun 29, 2026
Oleksii Oleksiyovych Lytvynenko, a Ukrainian national alleged to be a key member of the Conti ransomware group, was extradited from Ireland to the United States to face charges related to his involvement in global ransomware attacks. U.S. authorities accuse Lytvynenko of participating in Conti's double extortion operations between 2020 and June 2022, controlling stolen data, sending ransom notes, and extorting millions in cryptocurrency from victims worldwide, including specific incidents in Tennessee. He was arrested in Cork, Ireland, in July 2023 by Irish police at the request of the U.S., and after lengthy extradition proceedings, appeared in a Tennessee court facing charges of computer fraud conspiracy and wire fraud conspiracy, with a potential sentence of up to 25 years if convicted. The Conti ransomware group, which replaced the Ryuk operation in 2020, became one of the most prolific and aggressive ransomware syndicates, responsible for over 1,000 attacks in the U.S. and more than 30 countries, collecting approximately $150 million in ransom payments. The group targeted critical infrastructure and high-profile organizations, exploiting vulnerabilities such as Log4j and ProxyShell. After the group disbanded in 2022, its members, including Lytvynenko, allegedly continued cybercriminal activities. The U.S. Department of Justice and FBI have highlighted Conti's significant impact on global cybersecurity, with Lytvynenko's prosecution marking a major step in international law enforcement efforts against ransomware operators.
Jun 29, 2026
Russian national **Vladimir Dunaev** pleaded guilty in U.S. federal court for helping develop and deploy **TrickBot**, a malware platform used to steal credentials, harvest data, evade security tools, and enable ransomware attacks against hospitals, schools, businesses, and other victims. Prosecutors said TrickBot infected millions of computers, caused tens of millions of dollars in losses in the United States, and stole more than **$180 million** worldwide. Dunaev was arrested in South Korea on a U.S. extradition request, transferred to the United States in 2021, and now faces up to **35 years** in prison; his plea follows earlier action against alleged TrickBot developer **Alla Witte** and sanctions targeting other members the U.S. linked to Russian intelligence services. The guilty plea comes amid a broader U.S. crackdown on the **TrickBot-Conti** ecosystem, with federal indictments accusing multiple Russian nationals of developing, operating, and profiting from malware and ransomware campaigns tied to **Conti**, **Ryuk**, **Anchor**, **BazaLoader**, and related tooling. Court filings and security research describe TrickBot as both an initial-access and post-compromise framework: spam campaigns delivered obfuscated loaders, operators used browser manipulation and antivirus-evasion techniques, and intrusions progressed through credential dumping, domain enumeration, lateral movement, and **Cobalt Strike** activity before ransomware deployment. One indictment specifically tied alleged member **Maksim Galochkin** to the 2021 Conti attack on **Scripps Health**, while separate research has examined internal TrickBot roles and disputed attribution of the handle `bentley` among senior operators.
Aug 15, 2026