A Conti developer got four years for holding stolen data from 12 of the group's 1,000-plus victims

The count he pleaded to covers 12 victims whose stolen data he held, eight of them in the United States ^[4]. Conti hit more than 1,000 organizations before it disbanded in 2022 ^[1]. Twelve of more than a thousand is at most about 1.2 percent of the reported victim count ^[1]. Forty-eight months spread across those 12 companies is four months each ^[2].

The money proved in this case sits in Tennessee. Prosecutors said Lytvynenko and his co-conspirators extorted about $634,000 in Bitcoin from two victims there, one an undisclosed government entity where a sheriff's department, local emergency medical services and a local police department were compromised ^[7]. A third Tennessee victim refused a $3 million demand and had its stolen data leaked, according to an indictment unsealed last fall ^[8].

A. Tysen Duva, assistant attorney general of the Justice Department's criminal division, described him as both an intruder and a developer who helped build the tools Conti used to extort ^[10]. "Even after the Conti conspiracy ended, he continued engaging in active ransomware operations until his arrest," Duva said ^[9].

"Lytvynenko and his co-conspirators used Conti ransomware to attack computers and networks in nearly every state, and today's sentence reflects the gravity and extent of those crimes," said Brett Leatherman, assistant director of the FBI's cyber division ^[11]. "Ransomware criminals should know they are not anonymous and operating from overseas does not mean operating without consequences," he added ^[18].

Conti's run took in hundreds of critical infrastructure providers and the government of Costa Rica in 2022 ^[16]. After a 2022 leak exposed chats between members, the group rebuilt infrastructure and hit new targets ^[13]. It disbanded later that year, with members reappearing under Zeon, Black Basta and Quantum, which rebranded to Royal and then to BlackSuit in 2024 ^[12]. The State Department's $10 million reward is for information on Conti's leaders ^[14].

Four alleged co-conspirators, Maksim Galochkin, Maksim Rudenskiy, Mikhail Mikhailovich Tsarev and Andrey Yuryevich Zhuykov, were indicted in 2023 in the same federal court over Conti attacks from 2020 to 2022 ^[15]. Lytvynenko's admitted start date falls in the back half of that window ^[4]. The account of this sentencing reports no plea, no arrest and no sentence for any of the four, and no other Conti sentence to measure this one against ^[17].