Conti Ransomware Operator Oleksii Lytvynenko Extradited from Ireland to Face Federal Hacking Charges

2 November 2025: Oleksii Oleksiyovych Lytvynenko, a 43-year-old Ukrainian national residing in Cork, Ireland, has made his initial appearance in the Middle District of Tennessee following extradition from Ireland, according to The U.S. Department of Justice. He faces federal charges for conspiracy to commit computer fraud and conspiracy to commit wire fraud in connection with deploying the Conti ransomware, an operation prosecutors say extorted victims and stole data.

The indictment alleges that from around 2020 to about June 2022 Lytvynenko and others hacked into networks, encrypted data and demanded ransom payments in cryptocurrency to restore access or prevent leaks, with more than $500,000 in cryptocurrency extorted from two victims in the Middle District of Tennessee and information published from a third.

The Conti group first emerged in 2020 and was used to attack more than 1,000 victims worldwide, including roughly 47 states, the District of Columbia, Puerto Rico and about 31 foreign countries, per court filings. The DOJ notes that Conti’s activities included double-extortion tactics and that FBI data showed significant ransom payments, while An Garda Síochána arrested Lytvynenko in July 2023 at the request of U.S. authorities. If convicted, he faces up to five years in prison for computer fraud conspiracy and up to 20 years for wire fraud conspiracy.