Invest1 publisher2 min readPublished
Conti's $150m in victim payouts produces one four-year sentence
The Justice Department sentenced Oleksii Lytvynenko to four years over Conti, the ransomware the FBI ties to more than $150m in victim payouts as of January 2022 and to attacks in 47 states. Four others stand charged in the same district.
The Investor · Invest desk
What happened
- Oleksii Oleksiyovych Lytvynenko, 44, a Ukrainian national, was sentenced to four years in prison for a wire fraud conspiracy tied to deploying Conti ransomware.
- From 2020 until 2022, Conti was used against computers and networks in 47 states, 31 foreign countries, the District of Columbia and Puerto Rico.
- The FBI estimates that victim payouts associated with Conti exceeded $150,000,000 as of January 2022.
- He was arrested in County Cork, Ireland, in July 2023, and forensic artifacts recovered at the time showed he was still involved in ransomware activity.
- Five people have now been charged over Conti in the Middle District of Tennessee, four of them in an indictment unsealed in September 2023.
Compiled by The InvestorSomething wrong?How this is made
Why it matters
- cost Three FBI field offices, the Secret Service and Homeland Security Investigations in New York worked this case, and that staffing is the public price of a single four-year term.
- constraint Anyone sizing ransomware harm from this docket is working off a number 18 months older than the arrest, because the FBI's payout estimate stops in January 2022.
- precedent Four years for a man who both intruded and wrote code is now the visible rate that the next Conti-adjacent plea will be measured against.
- exposure Where an operator lives decided this case: a Ukrainian national settled in Cork was reachable, and the exposure of the remaining defendants turns on the same question.
Divide the FBI's estimate of more than $150,000,000 in Conti payouts by the 48 months of Lytvynenko's sentence and each month of prison stands against about $3.1m that victims paid [17]. The payout total and the victim count are both stated as minimums, more than $150m across more than 1,000 victims [5][2]. Divide one by the other and the average payment lands near $150,000 [18].
His own footprint inside that total is twelve companies. Investigators found data stolen from eight US victims and four overseas victims in his online accounts [11], a bit over 1% of the victims Conti infected [19]. He admitted joining a team run by a Conti conspirator and being directed to code a loader, malware used to load the programs that carry out other attacks [12]. "Even after the Conti conspiracy ended, he continued engaging in active ransomware operations until his arrest," said Assistant Attorney General A. Tysen Duva of the Justice Department's Criminal Division [6].
He pleaded guilty to wire fraud conspiracy on June 10 [10]. "Ransomware criminals should know they are not anonymous and operating from overseas does not mean operating without consequences," said Brett Leatherman, assistant director of the FBI's Cyber Division [9].
One of the five charged in Tennessee has now been sentenced [20]. The Justice Department did not say whether the other four are in custody [22].
Duva said the sentence "reflects the seriousness of ransomware and the Department's commitment to protecting America's hospitals, schools, businesses, and local governments" [23].
Two readings fit these facts. In the first, 48 months for a man who both broke into networks and built tools, and who kept at it after the group folded, is a low price, and the next developer offered the work can see the number. In the second, the term matters less than the venue, because a Ukrainian national living in Ireland ended up answering in a Tennessee court [1][3]. I lean to the second. The four co-defendants will settle it: sentences for them make four years the first entry in a schedule, and if they are never taken, this is one arrest in a country where arrest was possible [14].
What to watch
- Docket movement on the four co-defendants charged in the Middle District of Tennessee, including any arrest or plea.
- An updated FBI payout figure for Conti past the January 2022 cutoff, which would reset the size of the harm on the record.
- Whether prosecutors bring further Conti charges outside Tennessee, given that FBI San Diego and El Paso worked this case.