The U.S. Department of Justice on Thursday announced that a four year sentence was issued to Oleksii Oleksiyovych Lytvynenko, a Ukrainian lawyer who pleaded guilty to participating in the Russia-based Conti ransomware group, which has been blamed for attacks against more than 1,000 victims globally, including Tennessee businesses and law enforcement agency.
The original indictment against Lytvynenko states that “Conti conspirators” claimed credit for attacks on a Middle Tennessee sheriff’s department, another Middle Tennessee government entity, and gaining access to systems of another local law enforcement agency in Tennessee, while the plea agreement states that Lytvynenko admitted his email address connected him to stolen material from eight American victims and four from other countries.
According to the plea agreement, Lytvynenko’s eight American victims suffered more than $1.5 million in losses, while Lytvynenko was paid more than $25,000 worth of cryptocurrency for his role in the scheme. Law enforcement originally apprehended Lytvynenko in Cork, Ireland, in 2023, where court records show that he was accessing a Conti chatroom on a laptop.
Lytvynenko pleaded guilty to conspiracy to commit wire fraud, stipulating that prosecutors had enough evidence to prove his guilt beyond a reasonable doubt.
In addition to data stolen from 12 victims, Lytvynenko acknowledged using his Google account to research potential victims, storing Conti ransomware software and ransom notes for specific victims, and using the alias “henry” in a team run by a conspirator named “silver” or “buza.”
He also admitted to joining the conspiracy by September 2021, which was months before Lytvynenko left Ukraine for Ireland.
Through his actions, the Assistant Attorney General A. Tysen Duva said on Thursday that Lytvynenko had “personally” harmed “at least 12 companies.”
While DOJ records connecting Conti to Tennessee previously included charges against four Russian nationals in 2023, court records from Ireland describe Lytvynenko as a “Ukrainian national lawyer,” and reveal he spent two years fighting his extradition to the United States.
The Washington, D.C.-based national security outlet, CyberScoop, previously reported that Lytvynenko left Ukraine for Ireland in 2022, where he later obtained temporary protective status. Russia notably launched its invasion of Ukraine on February 24, 2022.
U.S. District Court Judge William Campbell Jr., who was appointed in 2018 by President Donald Trump, formally issued the sentence.
“Ransomware attacks like Conti cause real harm to businesses, institutions, and families here at home and around the world,” U.S. Attorney Braden Boucek stated on Thursday.
He added, “Today’s sentence demonstrates that cybercriminals cannot hide behind borders or a keyboard to escape justice. We are grateful to our law enforcement and international partners whose work made this result possible.”
Between 2020 and 2022, Conti is accused of committing ransomware attacks in 47 states, plus Washington, D.C. and Puerto Rico, as well as 31 foreign countries.
The guilty sentence is the latest in a string of foreign nationals who made guilty pleas or faced convictions in Tennessee, with the latest being a citizen of the United Kingdom convicted for child sex exploitation last month. He will face deportation to the United Kingdom after completing his sentence.
In June, a former South African Air Force pilot pleaded guilty to acting as a foreign agent while employed at Oak Ridge National Laboratory.
– – –
Tom Pappert is a 2025 recipient of the Dao Prize and the lead reporter for The Tennessee Star. He also reports for the Star News Network. Follow Tom on X. Email tips to [email protected].
