Oleksii Oleksiyovych Lytvynenko asked the court to see him as a “minimal participant.” A US federal judge sentenced him on Thursday to four years in prison for his part in the Conti ransomware operation.
Lytvynenko, 44, is Ukrainian. He pleaded guilty in June to wire fraud conspiracy, a felony that carries up to 20 years. Prosecutors dropped a separate computer fraud conspiracy charge under the plea agreement, which recommended a sentence of 41 to 51 months. Four years is 48.
What he did
Under the hood, the case is about a loader. Using the handle “henry,” Lytvynenko joined another Conti operator’s team to help build the malicious loader, the piece that gets the payload onto a victim’s machine. He received five bitcoin payments in his Binance account for it, worth about $30,000 at the time, between July and October 2021.
The Justice Department says he did more than write code. Assistant Attorney General A. Tysen Duva said he joined the conspiracy “as both an intruder and a developer,” personally harming at least 12 companies. Prosecutors said eight were US victims, reporting at least $1.5 million in losses, and four were abroad. Duva added that he kept working in ransomware after Conti ended, until his arrest.
The evidence was in his own accounts. Investigators seized his laptop and found Conti ransom notes sent to those victims, malware including Conti, and instructional material on malware and hacking in his Google Drive. More stolen data sat on the New Zealand file-hosting service Mega.NZ. He had also used his Google account to search zoominfo.com for information on potential victims.
The case’s long road
A grand jury indicted him in May 2023. The US asked Ireland for extradition that June, and he was arrested in Cork in July. In a handwritten letter in Russian, received by the court on April 21, he argued that the allegations were too vague because prosecutors had not set out his role in the attacks on three Tennessee victims. He said they had not shown he personally received proceeds, and that some victims never paid. He also asked the court to help him establish refugee status. He had earlier received temporary protection in Ireland after Russia’s invasion of Ukraine.
Conti itself is gone. It disbanded in spring 2022 after internal acrimony over Russia’s invasion, once its leadership declared support for the Kremlin. By January 2022 the FBI estimated it had extorted over $150 million from more than 1,000 victims. Four other Conti operators, all Russian nationals, were charged in the same court in September 2023: Maksim Galochkin, Maksim Rudenskiy, Mikhail Mikhailovich Tsarev and Andrey Yuryevich Zhuykov.
