Four years in prison for one of Conti's developers

A 44 year old Ukrainian man was sentenced in the United States on 10 September 2026 to four years in prison for his part in the Conti ransomware operation. Oleksii Oleksiyovych Lytvynenko, formerly of Cork in Ireland, was convicted of conspiracy to commit wire fraud. The US Department of Justice says he worked as both an intruder and a developer, that he personally harmed at least twelve companies, and that he was directed to code a loader, malware whose usual job is to fetch and launch the next stage of an attack. Data stolen from eight US victims and four overseas victims was recovered from his online accounts. He pleaded guilty on 10 June 2026.

Between 2020 and 2022 Conti was used against computers and networks in 47 US states, 31 foreign countries, the District of Columbia and Puerto Rico, hitting more than 1,000 victims. The FBI estimates that payments from victims had passed 150 million dollars by January 2022, and that in 2021 Conti was used against more critical infrastructure victims than any other ransomware variant. According to the indictment, Lytvynenko and his co-conspirators extorted more than 500,000 dollars in cryptocurrency from two victims in Tennessee and published data stolen from a third. Prosecutors also say he stayed in the ransomware business after Conti itself had ended, right up to his arrest in Cork in July 2023. His extradition to the United States was completed in October 2025.

The joint advisory on Conti from CISA, the FBI, the NSA and the US Secret Service, last revised on 9 March 2022, lists these among the ways in: targeted phishing whose attachment pulled in TrickBot or IcedID, stolen or weak RDP credentials, and common vulnerabilities in internet facing assets. The advisory points to a leaked actor playbook, in which PrintNightmare (CVE-2021-34527) and Zerologon (CVE-2020-1472) are listed among the flaws used to escalate privileges and move laterally once the actors were inside. Data was often taken out with the open source tool Rclone, after which the group encrypted the files and threatened to publish what it had stolen if the victim did not pay.

What this means for you if you are responsible for preparedness

A sentence closes a case, not a risk. Conti disappeared as a brand in 2022, yet the Justice Department says this man carried on with ransomware work until the police were at his door in Ireland the following year. That is the usual pattern: the name changes, the people stay. If your preparedness is built around group names, it goes out of date every time a name is retired. Build it around method instead, meaning phishing, stolen credentials and the abuse of remote management tools, and it will still hold against whoever comes next.

The second thing worth taking away is what sat in his accounts: data from twelve victims, long after the intrusions happened. If you have lost data in a breach, it is worth knowing that the material lives on in private hands long after the case is closed on your side. Our advice is to measure the follow up in years rather than weeks. The timeline here says much the same: arrest in July 2023, extradition in October 2025, sentence in September 2026. Law enforcement does arrive, but it arrives late, and your own risk reduction cannot wait for it. Report the incident all the same, because it was the traces left on accounts and devices that tied this man to his victims.

Berigo recommends

• Build detection and exercises around method rather than group names, so that they still hit when the name changes.
• Require multifactor authentication for all external access, and close any RDP exposed to the internet.
• Segment the network so that an intrusion on one machine does not open the way to everything you have.
• Rehearse the version where the data is already gone. Decide in advance who notifies those affected and who speaks to the regulator.
• Report the incident to the police, and preserve logs and devices before anything is cleaned up.