A Ukrainian national who coded first-stage malware for the Conti ransomware operation — one of the most destructive criminal enterprises in recent history — pleaded guilty on June 10 in federal court in Tennessee, delivering a new accountability signal in the same week the FBI formally launched Operation Riptide, its sweeping 60-day cybercrime campaign.
Oleksii Oleksiyovych Lytvynenko, 44, admitted to conspiracy to commit wire fraud for his role in a criminal enterprise that the U.S. Department of Justice says collected at least $150 million in ransom payments from more than 1,000 compromised networks across 47 U.S. states, the District of Columbia, Puerto Rico, and 31 foreign countries. He faces a maximum of 20 years in federal prison. Sentencing is scheduled for September 10, 2026.
The case underscores a message the Justice Department has sent repeatedly across several years of international enforcement: disbanding does not mean impunity, and individual technical roles within a criminal enterprise — not just its leaders — carry real federal exposure.
What Lytvynenko Actually Built Inside Conti
Lytvynenko’s guilty plea is notable not just for the charge but for the technical specificity it introduces into the public record. He did not merely deploy ransomware — he coded a loader, first-stage malware that installs or runs the programs needed for subsequent attacks. In Conti’s attack chain, a loader was the mechanism that delivered tools such as Cobalt Strike — the legitimate penetration-testing platform routinely weaponized by ransomware groups for lateral movement across victim networks — before the ransomware payload itself was detonated.
Lytvynenko joined the Conti conspiracy no later than September 2021, when a Conti team leader directed him to work on loader development alongside a dedicated team. He admitted to possessing stolen data from eight U.S. victims and four overseas victims. Together with co-conspirators, he extorted approximately $634,000 in Bitcoin from two Tennessee victims, including a government entity whose compromise extended to a local sheriff’s department. When a third Tennessee victim refused a $3 million ransom demand, Lytvynenko and the others published that victim’s stolen data online — Conti’s standard punishment for non-payment.
Prosecutors said he was arrested in Cork, Ireland, in July 2023 — reportedly found asleep with an open laptop running Cobalt Strike within arm’s reach. He was transferred to U.S. custody in October 2025 and has been held in Tennessee since.
How Conti’s Corporate Structure Is Now Working Against It
Most ransomware-as-a-service operations split ransoms with affiliates who deploy the malware — a percentage-cut model that makes individual accountability harder to establish. Conti operated differently: it paid its operators fixed wages, more like a criminal corporation with differentiated job roles than a commission-based network. That structure, exposed in the 60,000-file internal leak of February 2022, is now a legal liability for anyone who held a named role within it.
The Lytvynenko prosecution is the most direct public demonstration of that liability. Federal prosecutors charged him specifically as a loader developer — a distinct technical function within the attack chain, not a generic ransomware participant. Four alleged core conspirators, all Russian nationals — Maksim Galochkin, Maksim Rudenskiy, Mikhail Mikhailovich Tsarev, and Andrey Yuryevich Zhuykov — were indicted in the Middle District of Tennessee in September 2023. Those cases remain pending; all four are presumed innocent.
Operation Riptide: The Prosecution in Context
The Lytvynenko guilty plea came two days after the FBI formally announced Operation Riptide on June 9, 2026 — a coordinated, ongoing enforcement campaign implementing Executive Order 14390 and the Trump administration’s National Cyber Strategy. Operation Riptide targets not just individual actors but the infrastructure, communications platforms, and financial networks that sustain criminal ecosystems.
The operation’s first major enforcement action was the international takedown of First VPN Service, a virtual private network that at least 25 ransomware groups had used to conceal their operations. The Lytvynenko plea is its second significant publicly announced result. The FBI reported that Americans filed more than 1 million complaints about cybercrime last year, reporting over $20 billion in losses — a 26% increase in a single year — with ransomware accounting for a significant share of that total.
“The defendant and his conspirators used the Conti ransomware to terrorize people and businesses in the United States and around the world, causing millions of dollars in damage,” said Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division. “Ransomware continues to pose a threat to all business organizations, from critical infrastructure to small businesses. The Justice Department will continue to work with international partners to bring to justice anyone, anywhere who attacks the United States with ransomware.”
FBI Cyber Division Assistant Director Brett Leatherman said the case demonstrates that the Bureau and its partners “will relentlessly pursue those responsible for cybercrimes, regardless of where they operate.”
The investigation was conducted by the FBI’s San Diego, Nashville, and El Paso field offices alongside the U.S. Secret Service. The arrest and extradition involved the Irish Department of Justice, the Office of the Attorney General, and the Garda National Cyber Crime Bureau.
Hospitals and Governments Were Primary Targets
Healthcare organizations bore a particular burden from Conti’s campaigns. In 2021, Conti was responsible for the near-total shutdown of Ireland’s Health Service Executive — forcing the entire national health system offline for weeks and demanding a $20 million ransom. That same year, Conti attacked Scripps Health in San Diego, taking portions of the health system’s network offline for weeks and disrupting care at Scripps and neighboring UC San Diego Health. Those attacks are linked to Maksim Galochkin, one of the four co-conspirators indicted in 2023 who is still awaiting trial.
In Tennessee, Conti’s reach extended beyond the two victims Lytvynenko directly extorted to include a local police department and local emergency medical services. Separate 2023 court filings described Conti as responsible for attacks on hundreds of U.S. organizations.
Is Conti’s Threat Over? Its Successors Say No.
Conti disbanded in name in May 2022. The operational reality is more complicated. Researchers have traced its personnel, tooling, and infrastructure to a cluster of successor groups. Black Basta — widely believed to be staffed by former Conti members — emerged in April 2022 and carried out more than 500 attacks, including the May 2024 breach of Ascension Health that disrupted operations at roughly 140 hospitals across 19 U.S. states. Black Basta’s internal chats were leaked in February 2025, triggering its effective collapse; former operators are now assessed to have migrated to CACTUS and SafePay ransomware groups.
Akira — another group with documented Conti personnel and infrastructure overlap — is assessed by TRM Labs to have collected $150 million in ransom payments in 2025 alone, with cumulative totals exceeding $244 million as of early 2026. CISA has updated its ransomware guidance in 2025 and 2026 specifically to account for Conti successor groups’ inherited attack methods.
The Conti malware itself used AES-256 encryption across up to 32 simultaneous CPU threads, making it faster at encrypting victim networks than most competing ransomware variants at the time. That architectural approach — rapid, wide-area encryption combined with simultaneous data exfiltration for double-extortion leverage — became the blueprint for the groups that followed.
What a $20 Billion Annual Loss Rate Means for Your Organization
The FBI’s cybercrime complaint data provides context for why this prosecution matters beyond one defendant. Americans reported $20 billion in cybercrime losses last year — a figure that translates to operational disruption, ransom payments, remediation costs, and healthcare impacts across the full range of targets Conti and its successors have pursued: hospitals, municipal governments, school districts, and businesses of every size.
Organizations in healthcare, state and local government, and critical infrastructure remain the highest-risk categories. CISA’s updated guidance recommends maintaining regular backups stored offline and isolated from network access, enforcing phishing-resistant multifactor authentication on all remote access systems, segmenting networks to limit an attacker’s ability to move laterally, and developing incident response plans that do not assume ransomware payments will result in full data recovery.
“These criminal enterprises are sophisticated, but our prosecutors are up to this challenge and are dedicated to rooting these thieves out and holding them accountable,” said U.S. Attorney Braden H. Boucek for the Middle District of Tennessee.
Lytvynenko’s sentencing is set for September 10, 2026 in federal court. The FBI has signaled additional arrests, seizures, and takedowns under Operation Riptide as its initial 60-day campaign continues.
Frequently Asked Questions
Is Conti ransomware still active?
Conti itself disbanded in May 2022, but its personnel, tools, and techniques live on in successor groups. Security researchers have documented Conti-lineage operators in Akira, CACTUS, SafePay, BlackByte, and Royal. Akira alone is estimated to have collected $150 million in ransoms in 2025. The threat did not end with the group’s dissolution — it fragmented into multiple active operations that continue to target hospitals, governments, and critical infrastructure.
How does ransomware like Conti actually work?
Conti’s attack chain began with a loader — the first-stage malware Lytvynenko helped code — which delivered tools like Cobalt Strike onto victim networks. Cobalt Strike enabled attackers to move laterally across an organization’s systems before the ransomware payload was deployed. Conti encrypted files using AES-256 across up to 32 CPU threads simultaneously, making it unusually fast. Simultaneously, data was exfiltrated for double-extortion: if a victim refused to pay for decryption, attackers threatened to publish the stolen data publicly. Conti’s unique wage-employment model — paying staff salaries rather than ransom percentages — meant each functional role in the attack chain was held by a specific, identifiable person, which is now making role-specific prosecution possible.
What is Operation Riptide and how does it change cybercrime enforcement?
Operation Riptide is an ongoing FBI campaign launched June 9, 2026, implementing Executive Order 14390 and the Trump administration’s National Cyber Strategy. Unlike conventional prosecutions targeting individual defendants, it pursues the full support infrastructure of cybercrime networks — VPN services, forums, cryptocurrency laundering operations, and communications platforms. The Lytvynenko guilty plea and the First VPN Service takedown are its first two publicly announced results. The FBI has indicated additional arrests and seizures will follow within the operation’s initial 60-day window.
What should organizations do to protect against Conti-style ransomware attacks?
CISA recommends maintaining regular backups stored offline and isolated from the network, enforcing phishing-resistant multifactor authentication on all remote access points, segmenting networks to limit an attacker’s lateral movement, and developing incident response plans that do not assume ransom payment will result in full data recovery. Organizations that believe they may be current or past victims of Conti or its successor groups should contact their local FBI field office or file a complaint at ic3.gov.
