Ukrainian lawyer's second career as a Conti coder earns him 4 years behind bars

A Ukrainian lawyer who wound up coding malware for the Conti ransomware gang has been sentenced to four years in a US prison.

Oleksii Oleksiyovych Lytvynenko, 44, pleaded guilty in June to conspiracy to commit wire fraud over his role in Conti, the Russia-linked ransomware operation associated with more than 1,000 victims and at least $150 million in ransom payments.

Lytvynenko took an unusual route into the ransomware business.

The Ukrainian national, who later lived in Cork, Ireland, trained as a lawyer before joining Conti as an intruder and developer.

According to his plea agreement [PDF], Lytvynenko operated under the handle "henry" and joined a team run by another Conti conspirator known as "silver" or "buza." He was recruited to help with coding and directed to work on a malware loader – software designed to get other malicious code running on a victim's machine.

Prosecutors said his Google account showed he had also been doing some homework.

Investigators found books and videos about malware and hacking alongside Conti malware, ransom notes, and stolen victim data.

Prosecutors said he also used Google and ZoomInfo to research potential targets.

Lytvynenko wasn't confined to writing code, according to the filing.

Evidence from his online accounts showed that he possessed data stolen from eight US victims and four overseas, with the eight American victims reporting more than $1.5 million in losses.

Court documents identify several Bitcoin transfers tied to his Conti work, including 0.4 BTC worth $25,042 that prosecutors traced back to one of his victims.

He has been ordered to forfeit the same amount.

Conti disbanded in 2022 after its internal chats and source code were leaked following the gang's public support for Russia's invasion of Ukraine.

Lytvynenko apparently didn't take that as his cue to find another line of work.