---
schema: 1
kind: threat
title: Conti loader developer Oleksii Lytvynenko pleads guilty in US federal court after extradition from Ireland
headline: Conti loader developer Oleksii Lytvynenko pleads guilty in US federal court after extradition from Ireland
summary: "Oleksii Oleksiyovych Lytvynenko, a 44-year-old Ukrainian national, pleaded guilty on 12 June in the Middle District of Tennessee to conspiracy to commit wire fraud for his role in the Conti ransomware operation, which he joined around September 2021 to develop a malware loader component (CyberScoop, 2026-06-12)."
discovered_at: "2026-06-14T05:00:01Z"
event_date: 2026-06-12
run_id: 2026-06-14-e1d80e78
priority: notable
immediate_action: null
tags:
  - ransomware
  - organized-crime
  - law-enforcement
regions:
  - us
  - europe
sectors:
  - public-sector
entities:
  - "incident:conti-lytvynenko-guilty-plea-2026"
cves: []
sources:
  - url: "https://www.globalsecurity.org/security/library/news/2026/06/sec-260612-doj01.htm"
    publisher: US DOJ press release (mirror)
    role: primary
  - url: "https://cyberscoop.com/conti-ransomware-member-ukrainian-lytvynenko-guilty/"
    publisher: CyberScoop
    role: corroborating
  - url: "https://www.bleepingcomputer.com/news/security/ukrainian-national-pleads-guilty-to-role-in-conti-ransomware-operation/"
    publisher: BleepingComputer
    role: corroborating
closed_sources: []
evidence: []
verification: multi-source
sourcing_note: null
confidence: high
update_of: null
references: []
deep_dive: false
deep_dive_category: null
org_triage: null
watchlist_hit: false
actions: []
migrated_from: briefs/2026-06-14.md
---

Oleksii Oleksiyovych Lytvynenko, a 44-year-old Ukrainian national, pleaded guilty on 12 June in the Middle District of Tennessee to conspiracy to commit wire fraud for his role in the Conti ransomware operation, which he joined around September 2021 to develop a malware loader component ([CyberScoop, 2026-06-12](https://cyberscoop.com/conti-ransomware-member-ukrainian-lytvynenko-guilty/)). He admitted to possessing data stolen from eight US and four overseas victims; Conti attacked more than 1,000 organisations across 31 countries and extorted at least $150 million before disbanding in 2022 ([BleepingComputer, 2026-06-12](https://www.bleepingcomputer.com/news/security/ukrainian-national-pleads-guilty-to-role-in-conti-ransomware-operation/)). Lytvynenko was arrested in Cork, Ireland in July 2023 and extradited to the US in October 2025; he faces up to 20 years, with sentencing scheduled for 10 September. Four other alleged Conti members were indicted in 2023.

**Why it matters to us:** The case is a concrete demonstration that the EU-member-state → US extradition channel works against ransomware-lineage defendants who seek refuge in Europe — a deterrence data point for IR and legal teams weighing the realistic odds of prosecution. Conti's successor clusters (Black Basta, Quantum/Royal/BlackSuit, Zeon) remain active, so the plea closes a personnel chapter, not the threat.