Search/Conti Suspect in Court After Extradition From Ireland
● Story

Conti Suspect in Court After Extradition From Ireland

Alleged Conti ransomware gang affiliate appears in Tennessee court after Ireland extradition A Ukrainian national accused of launching ransomware attacks on behalf of the Conti group appeared in a U.S. court on Thursday after being extradited from Ireland. Oleksii Oleksiyovych Lytvynenko is facing several charges related to his suspected involvement with the Conti ransomware gang, which attacked hundreds of organizations globally before disbanding in 2022. The 43-year-old was indicted in 2023 on computer fraud conspiracy and wire fraud conspiracy charges. If convicted, he is facing a maximum penalty of 25 years in prison. Lytvynenko was arrested at his home in Cork, Ireland, by the country’s Garda Síochána national police in July 2023 at the request of U.S. authorities. U.S. prosecutors…

View graph Export
CVEs
0
Highest CVSS
—
In KEV
0
Sources
4
Connections
8 relationships
DragonForce Cartel Emerges as Conti-Derived Ransomware Threat
A new ransomware operation built on Conti’s leaked source code has surfaced with cartel-like ambitions in the cybercrime ecosystem. The DragonForce group, which retains Conti’s core encryption behavior and network-spreading capabilities, has begun conducting coordinated attacks and recruiting affiliates using a shared platform. Recently, DragonForce has shifted from a standard ransomware-as-a-service model to a self-styled cartel structure that encourages affiliates to create branded variants. This evolution has been highlighted by recent samples showing groups like Devman deploying ransomware compiled with DragonForce’s builder. According to Acronis Threat Research Unit (TRU) researchers, DragonForce uses the same ChaCha20 and RSA encryption combination found in Conti, generating a unique key per file and appending a 10-byte metadata block that encodes encryption mode, percentage and size. Operators have continued active campaigns, threatening to delete decryptors and leak data on September 2 and September 22. Technical Characteristics DragonForce encrypts both local storage and network shares via SMB (Server Message Block). Acronis has documented unchanged Conti-style routines alongside a hidden configuration system that replaces visible command-line parameters. The ransomware supports several encryption modes: Full mode (0x24) Partial (0x25) Header-only (0x26) Growing Affiliate Network Devman’s emergence illustrates DragonForce’s recruitment model. The group initially deployed a Mamona-based variant before shifting to a DragonForce-built strain with near-identical ransom note formatting. The timing suggests Devman first tested branding under Mamona, a project linked to operators behind Eldorado and BlackLock, then moved into the DragonForce ecosystem to leverage its tooling and infrastructure. DragonForce has also aligned with Scattered Spider, a group known for initial access operations tied to BlackCat, Ransomhub and Qilin. This partnership drew scrutiny following an incident impacting UK retailer Marks & Spencer, which researchers attribute to cooperative DragonForce–Scattered Spider activity shortly after DragonForce rebranded as a “cartel.” Aggressive Tactics and Defense The group has pursued aggressive dominance tactics, defacing BlackLock’s leak site and attempting a takeover of Ransomhub’s servers. This pressure may have forced some Ransomhub affiliates to migrate to rivals such as Qilin and DragonForce. “By rebranding itself as a ‘cartel,’ DragonForce aimed to strengthen its influence and alliances in the ransomware landscape, proving its dominance by defacing or taking control of rival groups’ infrastructure,” Acronis said. To defend against ransomware threats, security experts advise organizations to implement robust backup practices, restrict lateral movement through network segmentation and monitor for unusual access to shared resources. In addition, consistent patching, endpoint protection and user awareness training remain core layers of defense against financially motivated actors seeking to exploit gaps in enterprise environments.
infosecurity-magazine.comNov 4, 2025extracted
Conti Suspect in Court After Extradition From Ireland
A Ukrainian man has been extradited from Ireland and charged in the US with conspiracy to deploy Conti, a notorious ransomware variant. Oleksii Oleksiyovych Lytvynenko, 43, of Cork, Ireland, conspired with others to hack into victims’ computers, steal and encrypt their data, and extort them. Lytvynenko appeared in a Tennessee court late last week due to a 2023 indictment which alleges his part in the Conti operation between 2020 and July 2022. He helped the group to extort more than $500,000 in cryptocurrency from two victims in the district, and published information stolen from a third, the Justice Department claimed. However, the reach of Conti goes far further than the Middle District of Tennessee. In fact, the variant was used to target over 1000 corporate victims around the world, in dozens of countries and almost all states of the US, the DoJ said. Conti was used to attack more critical national infrastructure (CNI) than any other ransomware type, causing losses of at least $150m, it continued. This makes the group a national security threat as well as a menace to boardrooms around the world. Lytvynenko is alleged to have “controlled” data stolen from Conti victims and helped to manage the ransom notes deployed to victims’ systems. Irish Police Swoop on Suspect Court documents also alleged that the Ukrainian participated in cybercrime until his arrest in Ireland in July 2023. “Lytvynenko conspired to deploy Conti ransomware against victims in the United States and across the globe, extorting millions in cryptocurrency and amassing a trove of stolen data,” said assistant director Brett Leatherman of the FBI’s Cyber Division. “His extradition demonstrates the strength of our partnership with Irish law enforcement and the FBI’s commitment to counter cybercriminals who threaten American infrastructure. We urge every organization to remain vigilant and quickly report ransomware intrusions to your local FBI field office.” Lytvynenko is charged with computer fraud conspiracy and wire fraud conspiracy, and if convicted could face a maximum of 25 years behind bars. In February 2022, Conti generated some unusual publicity after a Ukrainian security researcher doxxed the criminal organization behind it. That decision was taken after Conti released a statement strongly in support of Russia’s invasion of Ukraine. Among the more eye-catching stories to emerge was the news that the group spent an estimated $6m on employee salaries, tooling and professional services from January 2021 to February 2022.
infosecurity-magazine.comNov 3, 2025extracted
Ukrainian Man Extradited From Ireland to US Over Conti Ransomware Charges
A Ukrainian national who fled to Ireland following the Russian invasion has been extradited to the United States to face charges related to his alleged involvement in Conti ransomware attacks. The suspect, 43-year-old Oleksii Oleksiyovych Lytvynenko, along with his wife and child, was granted temporary protection in Ireland in 2022 after fleeing Ukraine due to the war. However, Lytvynenko, who has been described as a lawyer by Irish news outlets, was arrested by Irish authorities in July 2023 at the request of the United States. He has been in custody ever since, trying to fight the US’s attempt to have him extradited. He recently lost an appeal in an Irish court and has been extradited, with the US Justice Department announcing his initial appearance in a Tennessee court on Thursday. Lytvynenko had argued that his extradition to the United States would violate his right to a fair trial. The man said he was unable to collect evidence and witnesses from Ukraine for his defense. According to the Justice Department, the Ukrainian national was involved in Conti ransomware attacks between 2020 and June 2022, when the Conti operation shut down. However, authorities believe Lytvynenko was involved in cybercriminal activities up until his arrest in 2023. Charges were filed against the man in Tennessee, where two victims of Conti attacks were extorted of more than $500,000 in cryptocurrency, and a third victim from this state, which presumably refused to pay a ransom, had its data made public. Lytvynenko has been charged with computer fraud conspiracy, for which he faces up to five years in prison, and wire fraud conspiracy, for which he can be sentenced to a maximum of 20 years. Data collected by the FBI shows that the Conti ransomware operation made over 1,000 victims worldwide and obtained at least $150 million in ransom payments by January 2022. The US in recent years announced charges against several Ukrainian and Russian nationals accused of being involved in ransomware attacks, and some of them have been sentenced to prison. Authorities in Germany recently announced that a Russian national named Vitaly Nikolaevich Kovalev is believed to be the leader of the Conti and TrickBot cybercrime groups. Kovalev is apparently still at large. Related: France Says Administrator of Cybercrime Forum XSS Arrested in Ukraine Related: Scattered Spider Suspect Arrested in US Related: Dutch Teens Arrested for Allegedly Helping Russian Hackers
securityweek.comOct 31, 2025extracted
Alleged Conti ransomware gang affiliate appears in Tennessee court after Ireland extradition
Alleged Conti ransomware gang affiliate appears in Tennessee court after Ireland extradition A Ukrainian national accused of launching ransomware attacks on behalf of the Conti group appeared in a U.S. court on Thursday after being extradited from Ireland. Oleksii Oleksiyovych Lytvynenko is facing several charges related to his suspected involvement with the Conti ransomware gang, which attacked hundreds of organizations globally before disbanding in 2022. The 43-year-old was indicted in 2023 on computer fraud conspiracy and wire fraud conspiracy charges. If convicted, he is facing a maximum penalty of 25 years in prison. Lytvynenko was arrested at his home in Cork, Ireland, by the country’s Garda Síochána national police in July 2023 at the request of U.S. authorities. U.S. prosecutors accuse Lytvynenko of being a Conti operator from 2020 to June 2022, infecting dozens of computers and networks before demanding ransoms. Lytvynenko was allegedly responsible for extorting about $500,000 from two victims in Tennessee and for publishing the stolen information of another organization in the state. Conti was one of the most active ransomware gangs at one point, and acting Assistant Attorney General Matthew Galeotti said Lytvynenko “allegedly participated in a conspiracy to extort approximately $150 million in ransomware payments.” Galeotti added that Lytvynenko is “responsible for defrauding victims in almost every U.S. state and from over two dozen countries worldwide.” Lytvynenko allegedly held data from a number of Conti victims and was involved in several attacks publicized by the group. When the group went defunct at the onset of Russia’s invasion into Ukraine, Lytvynenko allegedly continued his involvement in cybercrime. The DOJ did not respond to requests for comment about whether he was involved in other ransomware gangs. He had been held in an Irish jail since 2023 and went through lengthy extradition proceedings before being sent to the U.S. this month. “Lytvynenko conspired to deploy Conti ransomware against victims in the United States and across the globe, extorting millions in cryptocurrency and amassing a trove of stolen data,” said FBI Cyber Division assistant director Brett Leatherman. Four other members of the Conti ransomware gang were indicted in September 2023 after U.S. prosecutors accused them of targeting hospital systems, local governments, a local sheriff’s department, and local emergency medical services. Another member of Conti was arrested by Ukrainian authorities last year in Kyiv. Before shuttering its operation in 2022, the ransomware gang was in the midst of a devastating attack on the government of Costa Rica and had demanded a $20 million ransom. A member of Conti, believed to be Ukrainian, leaked the gang's internal chats after the group's leaders posted an aggressive pro-Russian message on their official site following Russia’s invasion of Ukraine. The leaked messages illustrated the group’s ruthless stances toward attacking U.S. hospitals during the COVID-19 pandemic and its ties to the Russian government. Researchers have traced several newer ransomware gangs — like Royal, Black Basta, and others — back to Conti. Jonathan Greig is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.
therecord.mediaOct 31, 2025extracted
Related Stories
1
FBI Seizes $2.4m in Crypto from Chaos Ransomware Gang
INFOSEC IN BRIEF A computer intrusion hit the US spy satellite agency, but officials insist no classified secrets were lost - just some unclassified ones, apparently. The National Reconnaissance Office (NRO) confirmed to The Register that attackers gained limited access to its networks, but no classified data was exposed. It would not answer whether the attack was linked to the SharePoint vulnerability that was used to break into other government agencies, such as the US National Nuclear Security Administration. "We can confirm that an incident involving our unclassified Acquisition Research Center (ARC) website is currently being investigated in collaboration with federal law enforcement," the agency said. "We do not comment on ongoing investigations." REG AD News of the breach was reported earlier by the Washington Times. REG AD The ARC is the NRO's unclassified portal for vendors to pitch their tech and bid on contracts, but it's not connected to classified networks — which, according to the agency, means any awarded contract details should be safe. It also works as a market research tool for staff as they can see what technologies are available. According to the Washington Times, however, attackers may have obtained sensitive information related to CIA technology acquisition efforts, including data tied to the agency's Digital Hammer program. That initiative, announced three years ago by the CIA's Open Source Enterprise director Randy Nixon, was designed to fast-track innovative tools for surveillance and intelligence gathering. The CIA, characteristically, has nothing to say on the matter and the NRO has reportedly notified any companies affected by the breach. Tea app secrets spilled by server snafu Tea, an application ostensibly created to make women safer by allowing them to swap notes on potential paramours, has suffered a major data breach, exposing 72,000 images (13,000 selfies and photo IDs, and 59,000 pictures from app posts and direct messages). The app, which was the top-downloaded free app on the Apple App Store this week and reportedly has more than 1.6 million users, lets them share notes on specific men and comment on their dating experiences. It includes a so-called Catfish Finder AI tool that uses reverse image searches and public records to help flag suspicious identities, including known aliases and criminal histories, if found. "It’s basically Yelp for exes," said one reviewer. "You get to see what people say about the person you’re thinking about matching with. And listen, that’s a game-changer for the girls who are done wasting time on smooth-talking liabilities." Users on 4chan surfaced the exposed database, which was apparently hosted in an unsecured Firebase storage bucket tied to Tea's mobile app. On Friday, the app's makers told 404 Media that it had "identified unauthorized access to one of our systems and immediately launched a full investigation to assess the scope and impact." REG AD The app maker said that the exposed data was collected over two years ago, possibly before or around its 2023 launch, and claimed that the "data was originally stored in compliance with law enforcement requirements related to cyber-bullying prevention." Its female customers might feel slightly less than reassured by that, given that the whole point of the app, developed by former Salesforce director of product Sean Cook, was to help users stay safer by sharing experiences. We've asked Tea for more details and will update if additional information comes in. Blacksuit ransomware taken to the cleaners by cop, with little effect Visitors to the dark web site of the Blacksuit ransomware gang have likely had their hopes dashed - a global law‑enforcement action has seized the site, insiders tell us. The site [Onion link] now says that it has been taken down by Homeland Security as part of Operation Checkmate. The page includes the logos of the DHS, the US Secret Service, the National Crime Agency, and various other European and international law enforcement agencies, as you can see in the screenshot below. However, around the time of the takedown, Cisco reports seeing a relatively new ransomware-as-a-service group springing up, calling itself Chaos, that it believes was spun out of the Blacksuit gang. This is a tad confusing, since there's already a ransomware group going by that name, but Cisco suspects that this is an intentional bit of misdirection by the new group to cover its tracks. "Talos assesses with moderate confidence that the new group is likely formed by former members of the BlackSuit (Royal) gang, based on similarities in the ransomware's encryption methodology, ransom note structure, and the toolset used in the attacks," Cisco's security team said. This wouldn't be the first time a group has faked a shutdown. As we've seen most recently with Hunters International, many criminal groups will simply announce they are shutting down when they become notorious. Then they restart with a new brand and much the same methods. And even if they are legitimately shut down by the cops, they often come back within weeks or months, as with REvil. REG AD British student jailed for selling phishing kits A court in London has given Ollie Holman, 21, a seven-year prison sentence for selling over a thousand phishing kits online and tutoring customers on how to use them. Which is somewhat ironic, considering Holman was - at the time of his arrest - a student at the University of Kent studying electronic and computer engineering. Police estimate that over his two-year career as a criminal, Holman netted around £300,000, which he then laundered through cryptocurrency exchanges. Security biz WMC Global spotted the kits and tipped off the police, and after a European law enforcement investigation, he was arrested in October 2023 and later released on bail. But he continued offering support for the phishing kits via Telegram, leading to a second arrest in May 2024. "Holman acted with greed and profited handsomely from this illegal enterprise, funding his own lavish lifestyle at the expense of countless individuals and businesses who suffered devastating financial losses and emotional harm," said Sarah Jennings, specialist prosecutor for the Crown Prosecution Service. And he's not out of the woods yet. The CPS said that it would be taking Holman back to court to try and seize his assets - those it can find at least. EncroChat is the gift that keeps giving - to the police Police in the UK have jailed a drug dealer who was using the encrypted EncroChat by using messages referencing his semi-famous father. In 2020, after a three-year operation, Eurocops managed to infiltrate and then take down the EncroChat service, which was charging around £1,500 every six months to provide criminals with a supposedly secure method of communication. In the process, they harvested a lot of data from the site and, while some criminals were stupid enough to put names, addresses, and other real information in messages, others weren't. Police identified Thomas Hooton, 30, after an associate sent him a picture of his father, who unfortunately was rather famous - Peter Hooton, lead singer with the British band The Farm. That, along with messages in which Ownraptor mentioned driving a black Audi A3 insured by his "arl fella," helped investigators link the handle to him. Police checks confirmed the elder Hooton had indeed insured the car. Thomas Hooton pleaded guilty at Liverpool Crown Court to conspiring to supply heroin, cocaine, cannabis and ketamine with a reported wholesale value of around £1.3 million and was sentenced to 10 years and 8 months in prison. Meanwhile, police are back to combing through the EncroChat data to catch more crims. While the low-hanging fruit who identified themselves on the service have now mostly been caught, this is an interesting case of how the smallest details can lead to personal identification. And here's a bit of flashback for those of you, like our editor, who vaguely remembered The Farm's name but didn't remember what their hit song was:
2 shared
Jul 29, 2025