# Conti Ransomware Malware Developer Oleksii Lytvynenko Pleads Guilty to Wire Fraud Conspiracy (DOJ, June 2026)

> Ukrainian national Oleksii Oleksiyovych Lytvynenko (aka Alexsey Alexseevich Litvinenko), 44, a malware developer for the Conti ransomware operation, pleaded guilty on June 12, 2026 in U.S. federal court in Tennessee to conspiracy to commit wire fraud, facing up to 20 years. He joined Conti in September 2021, held data on 12 victims (8 U.S.-based), and was arrested in Cork, Ireland in July 2023 while asleep within arm's reach of a laptop running Cobalt Strike with active intrusions into victim networks.

- **Published:** 2026-06-12T00:00:00Z
- **Last reviewed:** 2026-06-12T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0785
- **ID:** TL-2026-0785
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Conti (Russia)
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On June 12, 2026, Oleksii Oleksiyovych Lytvynenko, a 44-year-old Ukrainian national also known as Alexsey Alexseevich Litvinenko, pleaded guilty in U.S. District Court for the Eastern District of Tennessee to conspiracy to commit wire fraud for his role as a malware developer in the Conti ransomware operation. He had been extradited from Ireland in early October 2025 and originally pleaded not guilty on October 31, 2025 before reversing his plea. Sentencing is scheduled for September 10, 2026, with a statutory maximum of 20 years in prison (his original indictment, which also charged computer fraud conspiracy, carried up to 25 years).

Lytvynenko admitted joining Conti in September 2021 and continuing to engage in cybercrime until his July 2023 arrest in Cork, Ireland — after he had left Ukraine in 2022 and obtained temporary protective status in Ireland. He told the court he developed malware that Conti used in some of its attacks and that he held stolen data on 12 victims, eight of them based in the United States. When Irish authorities arrested him, he was found asleep within arm's reach of an open laptop running Cobalt Strike, with active intrusions connected to victim networks and open chat applications discussing ongoing cyberattacks.

Prosecutors said Lytvynenko and co-conspirators extorted approximately $634,000 in Bitcoin from two Tennessee victims, including an undisclosed government entity whose compromise affected a sheriff's department, emergency medical services, and a local police department. A second Tennessee victim, a business, refused a $3 million ransom demand and had its stolen data leaked.

Conti was one of the most prolific ransomware-as-a-service operations ever tracked: the FBI attributes more than 1,000 victim attacks across 47 U.S. states, Washington D.C., and Puerto Rico, plus roughly 31 countries, with over $150 million in extorted ransom payments. Conti's intrusion playbook relied on TrickBot, BazarLoader, and IcedID for initial access and loading, Cobalt Strike for post-exploitation and command-and-control, Router Scan and Kerberos (Kerberoasting) attacks plus brute-forced/stolen RDP credentials for credential access and lateral movement, and the Rclone command-line utility for data exfiltration before deploying the Conti encryptor under a double-extortion model. The group disbanded in 2022 amid the 'ContiLeaks' internal disclosures, with members rebranding into successor operations including Zeon, Black Basta, and Quantum (later Royal, then BlackSuit in 2024). The case underscores continued international law-enforcement pressure on Conti-aligned actors; co-conspirators Maksim Galochkin, Maksim Rudenskiy, Mikhail Mikhailovich Tsarev, and Andrey Yuryevich Zhuykov were indicted in 2023.

## MITRE ATT&CK

- T1566 Phishing
- T1566.001 Spearphishing Attachment
- T1078 Valid Accounts
- T1133 External Remote Services
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1204.002 Malicious File
- T1133 External Remote Services
- T1068 Exploitation for Privilege Escalation
- T1685 Disable or Modify Tools
- T1027 Obfuscated Files or Information
- T1110 Brute Force
- T1558.003 Kerberoasting
- T1003.001 LSASS Memory
- T1018 Remote System Discovery
- T1046 Network Service Discovery
- T1135 Network Share Discovery
- T1021.001 Remote Desktop Protocol
- T1021.002 SMB/Windows Admin Shares
- T1570 Lateral Tool Transfer
- T1005 Data from Local System
- T1071.001 Web Protocols
- T1105 Ingress Tool Transfer
- T1219 Remote Access Tools
- T1567.002 Exfiltration to Cloud Storage
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery
- T1489 Service Stop
- T1657 Financial Theft

## Sources

- [Conti ransomware group member pleads guilty, faces up to 20 years in prison](https://cyberscoop.com/conti-ransomware-member-ukrainian-lytvynenko-guilty/)
- [Ukrainian National Extradited from Ireland in Connection with Conti Ransomware](https://www.justice.gov/opa/pr/ukrainian-national-extradited-ireland-connection-conti-ransomware)
- [Ukrainian allegedly involved in Conti ransomware attacks faces up to 25 years in jail](https://cyberscoop.com/ukrainian-oleksii-lytvynenko-conti-ransomware-extradited/)
- [Alleged Conti ransomware gang affiliate appears in Tennessee court after Ireland extradition](https://therecord.media/alleged-conti-ransomware-affiliate-extradited-ireland-tennessee)
- [Ukrainian extradited to US over Conti ransomware involvement](https://securityaffairs.com/184106/security/ukrainian-extradited-to-us-over-conti-ransomware-involvement.html)
- [Ukrainian Man Extradited From Ireland to US Over Conti Ransomware Charges](https://www.securityweek.com/ukrainian-man-extradited-from-ireland-to-us-over-conti-ransomware-charges/)
- [CISA/FBI Joint Cybersecurity Advisory AA21-265A: Conti Ransomware](https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-265a)
- [Conti Ransomware IoC — CISA updates nearly 100 domain names](https://www.socinvestigation.com/conti-ransomware-ioc-cybersecurity-infrastructure-security-agency-updates-nearly-100-domain-names/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0785