Threat reportRansomwareTL-2026-0785
Conti Ransomware Malware Developer Oleksii Lytvynenko Pleads Guilty to Wire Fraud Conspiracy (DOJ, June 2026)
Conti Ransomware Malware Developer Oleksii Lytvynenko Pleads (TL-2026-0785), also tracked as ContiLeaks, is a high-severity ransomware operation, first published 2026-06-12. It is attributed to Conti (Russia) with high confidence, affects Multiple Microsoft Windows enterprise environments (Active Directory, maps to 28 MITRE ATT&CK techniques (T1003.001, T1005, T1018), and is covered by 9 detection rules and 27 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 28MITRE ATT&CK
- Actors
- 1Conti
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 27Indicators of compromise
Key facts for TL-2026-0785
- Threat ID
- TL-2026-0785
- Also known as
- ContiLeaks, Operation Conti law-enforcement action
- Severity
- HIGH
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution
- Conti
- Attribution confidence
- HIGH
- Nation-state nexus
- Russia
- Motivation
- FINANCIAL
- Target sectors
- government, law enforcement, emergency services, healthcare, financial, manufacturing, critical infrastructure
- Target regions
- North America, Europe, United States, Tennessee
- Detection rules
- 9
- Indicators of compromise
- 27
Malware and tooling in Conti Ransomware Malware Developer Oleksii Lytvynenko Pleads
Malware and tooling: BazarBackdoor, Conti, IcedID, TrickBot, AnyDesk, Cobalt Strike, Rclone - S1040, Router Scan
How Conti Ransomware Malware Developer Oleksii Lytvynenko Pleads works
Ukrainian national Oleksii Oleksiyovych Lytvynenko (aka Alexsey Alexseevich Litvinenko), 44, a malware developer for the Conti ransomware operation, pleaded guilty on June 12, 2026 in U.S. federal court in Tennessee to conspiracy to commit wire fraud, facing up to 20 years. He joined Conti in September 2021, held data on 12 victims (8 U.S.-based), and was arrested in Cork, Ireland in July 2023 while asleep within arm's reach of a laptop running Cobalt Strike with active intrusions into victim networks.
On June 12, 2026, Oleksii Oleksiyovych Lytvynenko, a 44-year-old Ukrainian national also known as Alexsey Alexseevich Litvinenko, pleaded guilty in U.S. District Court for the Eastern District of Tennessee to conspiracy to commit wire fraud for his role as a malware developer in the Conti ransomware operation. He had been extradited from Ireland in early October 2025 and originally pleaded not guilty on October 31, 2025 before reversing his plea. Sentencing is scheduled for September 10, 2026, with a statutory maximum of 20 years in prison (his original indictment, which also charged computer fraud conspiracy, carried up to 25 years).
Lytvynenko admitted joining Conti in September 2021 and continuing to engage in cybercrime until his July 2023 arrest in Cork, Ireland — after he had left Ukraine in 2022 and obtained temporary protective status in Ireland. He told the court he developed malware that Conti used in some of its attacks and that he held stolen data on 12 victims, eight of them based in the United States. When Irish authorities arrested him, he was found asleep within arm's reach of an open laptop running Cobalt Strike, with active intrusions connected to victim networks and open chat applications discussing ongoing cyberattacks.
Prosecutors said Lytvynenko and co-conspirators extorted approximately $634,000 in Bitcoin from two Tennessee victims, including an undisclosed government entity whose compromise affected a sheriff's department, emergency medical services, and a local police department. A second Tennessee victim, a business, refused a $3 million ransom demand and had its stolen data leaked.
Conti was one of the most prolific ransomware-as-a-service operations ever tracked: the FBI attributes more than 1,000 victim attacks across 47 U.S. states, Washington D.C., and Puerto Rico, plus roughly 31 countries, with over $150 million in extorted ransom payments. Conti's intrusion playbook relied on TrickBot, BazarLoader, and IcedID for initial access and loading, Cobalt Strike for post-exploitation and command-and-control, Router Scan and Kerberos (Kerberoasting) attacks plus brute-forced/stolen RDP credentials for credential access and lateral movement, and the Rclone command-line utility for data exfiltration before deploying the Conti encryptor under a double-extortion model. The group disbanded in 2022 amid the 'ContiLeaks' internal disclosures, with members rebranding into successor operations including Zeon, Black Basta, and Quantum (later Royal, then BlackSuit in 2024). The case underscores continued international law-enforcement pressure on Conti-aligned actors; co-conspirators Maksim Galochkin, Maksim Rudenskiy, Mikhail Mikhailovich Tsarev, and Andrey Yuryevich Zhuykov were indicted in 2023.
MITRE ATT&CK techniques used in TL-2026-0785
Credential Access
T1003.001 LSASS Memory; T1110 Brute Force; T1558.003 Kerberoasting
Collection
Discovery
T1018 Remote System Discovery; T1046 Network Service Discovery; T1135 Network Share Discovery
Lateral Movement
T1021.001 Remote Desktop Protocol; T1021.002 SMB/Windows Admin Shares; T1570 Lateral Tool Transfer
Defense Evasion
T1027 Obfuscated Files or Information
Execution
T1059.001 PowerShell; T1059.003 Windows Command Shell; T1204.002 Malicious File
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Command and Control
T1071.001 Web Protocols; T1105 Ingress Tool Transfer; T1219 Remote Access Tools
Initial Access
T1078 Valid Accounts; T1133 External Remote Services; T1566 Phishing; T1566.001 Spearphishing Attachment
Persistence
T1133 External Remote Services
Impact
T1486 Data Encrypted for Impact; T1489 Service Stop; T1490 Inhibit System Recovery; T1657 Financial Theft
Exfiltration
T1567.002 Exfiltration to Cloud Storage
defense-impairment
Affected products and versions in Conti Ransomware Malware Developer Oleksii Lytvynenko Pleads
- Multiple — Microsoft Windows enterprise environments (Active Directory, RDP, SMB)
Vulnerable versions: Windows endpoints and servers exposed via RDP or compromised via TrickBot/BazarLoader/IcedID - Government / Public Sector — U.S. state and local government entities (Tennessee sheriff's department, EMS, police department)
Vulnerable versions: Networks accessed via stolen credentials and Cobalt Strike
Remediation for Conti Ransomware Malware Developer Oleksii Lytvynenko Pleads
Patches
- Apply vendor patches to internet-facing and internal assets to remove privilege-escalation and lateral-movement vectors Conti exploits
Immediate actions
- Block the four known Conti Cobalt Strike C2 IP addresses (162.244.80.235, 85.93.88.165, 185.141.63.120, 82.118.21.1) and the CISA-published Conti-associated domains at the perimeter
- Hunt for active Cobalt Strike beacons, anomalous RDP sessions, and Rclone execution across the environment
- Disable or tightly restrict externally exposed RDP; enforce MFA on all remote access
Workarounds
- Restrict outbound traffic to known-good destinations to break C2 and Rclone-based exfiltration
- Block or alert on remote-access tools (AnyDesk) not sanctioned by IT
Longer-term hardening
- Deploy EDR with behavioral detection tuned for TrickBot/BazarLoader/IcedID loaders and Cobalt Strike
- Implement network segmentation to contain lateral movement over SMB and RDP
- Maintain offline, immutable backups and regularly test ransomware recovery
- Monitor for Kerberoasting and LSASS credential dumping
Timeline of Conti Ransomware Malware Developer Oleksii Lytvynenko Pleads
- Conti conducted ransomware extortion campaigns against Tennessee victims (2020-2021), extorting ~$634,000 in Bitcoin from two entities including a government entity affecting a sheriff's department, EMS, and police.
- Oleksii Lytvynenko joined the Conti ransomware operation as a malware developer.
- Lytvynenko left Ukraine and obtained temporary protective status in Ireland.
- Conti disbanded in 2022 amid the ContiLeaks internal disclosures; members rebranded into Zeon, Black Basta, and Quantum (later Royal, then BlackSuit).
- Co-conspirators Maksim Galochkin, Maksim Rudenskiy, Mikhail Mikhailovich Tsarev, and Andrey Yuryevich Zhuykov indicted in 2023 for Conti/TrickBot-related crimes.
- Lytvynenko arrested in Cork, Ireland, found asleep within arm's reach of a laptop running Cobalt Strike with active intrusions into victim networks.
- Lytvynenko extradited from Ireland to the United States, into federal custody in Tennessee.
- Lytvynenko pleaded not guilty at arraignment in U.S. District Court in Tennessee.
- Lytvynenko pleaded guilty to conspiracy to commit wire fraud, admitting he developed Conti malware and held data on 12 victims (8 U.S.-based).
- Sentencing scheduled; statutory maximum of 20 years in prison.
Sources cited for Conti Ransomware Malware Developer Oleksii Lytvynenko Pleads
- Conti ransomware group member pleads guilty, faces up to 20 years in prison
- Ukrainian National Extradited from Ireland in Connection with Conti Ransomware
- Ukrainian allegedly involved in Conti ransomware attacks faces up to 25 years in jail
- Alleged Conti ransomware gang affiliate appears in Tennessee court after Ireland extradition
- Ukrainian extradited to US over Conti ransomware involvement
- Ukrainian Man Extradited From Ireland to US Over Conti Ransomware Charges
- CISA/FBI Joint Cybersecurity Advisory AA21-265A: Conti Ransomware
- Conti Ransomware IoC — CISA updates nearly 100 domain names
Detection coverage for TL-2026-0785
As of 2026-06-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0785 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.