Ukrainian lawyer's second career as a Conti coder earns him 4 years behind bars

A Ukrainian lawyer who transitioned into malware coding for the Conti ransomware group faces four years in an American prison. Oleksii Oleksiyovych Lytvynenko, aged 44, admitted guilt in June to conspiracy related to wire fraud within Conti, a Russia-linked ransomware operation responsible for over 1,000 victims and approximately $150 million in ransom money.

Prior to joining Conti, Lytvynenko, originally from Ukraine and later residing in Cork, Ireland, studied law and worked as an intruder and developer within the group. Operating under the alias "henry," he collaborated with a team led by another Connti figure known as "silver" or "buza." His recruitment involved coding and directing the development of a malware loader, software designed to facilitate the execution of other malicious code on a victim's computer.

Prosecutors discovered that Lytvynenko's Google account contained information about malware and hacking, along with Conti malware, ransom notes, and stolen victim data. He utilized Google and ZoomInfo to research potential targets. Lytvynenko's actions extended beyond coding, as evidence from his online accounts revealed possession of data stolen from eight US victims and four others abroad, with the eight American victims reporting losses exceeding $1.5 million.

Court documents detail several Bitcoin transactions linked to his Conti activities, including 0.4 BTC worth $25,042 traced to one of his victims. Lytvynenko retained his involvement in ransomware activities even after Conti disintegrated in 2022, as evidenced by the discovery of his laptop open, running Cobalt Strike, and connected to a Rocket.Chat session over Tor during a 2023 Irish raid.

Prosecutors argue that his involvement persisted even post-Conti's dissolution. Extradited to the US in October 2025, Lytvynenko now has four years to consider a career change.