Ukrainian Developer Sentenced in Conti Ransomware Case

Oleksii Lytvynenko, a 44-year-old Ukrainian national, was sentenced to four years in U.S. federal prison after admitting he helped develop malware for the Conti ransomware group and possessed stolen victim data. He pleaded guilty to a wire fraud charge in June 2026.

Lytvynenko was arrested in Ireland in 2023 and extradited to the United States in late 2025. Court filings state he joined the Conti operation in September 2021 and assisted in creating a malware loader used to deploy ransomware.

At his plea hearing Lytvynenko acknowledged developing malicious software and having data taken from victims in his possession. Investigators found files linked to victims on devices tied to him, and they allege he continued participating in ransomware activity after Conti declared it had ceased operations in 2022.

The wire fraud charge carried a statutory maximum sentence of 20 years; the court imposed a four-year term. Prosecutors linked Conti to at least $150 million in ransom payments. Court documents say the group encrypted files and threatened to release stolen information unless victims paid, and targeted organizations in more than 30 countries, including most U.S. states.

The sentencing follows other recent prosecutions of ransomware affiliates. A Latvian national, Deniss Zolotarjovs, received an 8.5-year prison term in the United States for work as a negotiator for the Karakurt group. A Belarusian individual identified in court records as the creator and administrator of the Ransom Cartel was given a 16-year sentence.

The Lytvynenko case involved investigations across multiple countries and used extradition to bring him to U.S. courts. He was charged with wire fraud for developing and distributing malware and for possessing stolen data taken from victims targeted by Conti and related operations.