Ukrainian police say they identified a 28-year-old Kyiv resident suspected of developing software to help ransomware evade antivirus detection. Investigators linked him to both Conti and LockBit, but the specific attack described in the police account used Conti malware against a company operating in the Netherlands and Belgium. The case was still under investigation when police published their account on June 12, 2024; the notice does not establish a conviction or final charge.
What Ukrainian police say happened
Ukraine’s Cyber Police Department said investigators identified a man originally from Kharkiv Oblast who lived in Kyiv. Police described his alleged specialty as developing “cryptors”—software that disguises malicious files as safe ones so they can evade antivirus detection. According to the police account, a Russian hacker group paid him in cryptocurrency to conceal Conti ransomware. Ukraine Cyber Police Department, June 12, 2024
Police said that in late 2021 members of the group used the concealed malware to infect the networks of a company in the Netherlands and Belgium. The systems became unusable, and the attackers demanded payment in exchange for decrypting the computers. The notice does not name the company.
Investigators said they established the suspect’s involvement with both Conti and LockBit. That broader link is distinct from the attack described in detail: police specifically identified Conti malware in that incident. The account does not say the suspect led either group.
#1 Best Overall
Arrest reporting and investigation status
A June 12, 2024, Dark Reading report, citing Dutch officials, said the suspect was taken into custody on April 18 as part of multinational cooperation connected to Operation Endgame. The Ukrainian police notice describes searches and an ongoing pre-trial investigation, but does not itself give that custody date. Dark Reading, June 12, 2024
Ukraine’s police said searches took place in Kyiv and, following an international request from Dutch law enforcement, in Kharkiv Oblast. Investigators seized computer equipment, mobile phones and notes. The notice said the pre-trial investigation was continuing and authorities were considering a possible charge under Part 5 of Article 361 of Ukraine’s Criminal Code. Police cited a potential maximum penalty of 15 years’ imprisonment, with possible additional legal classification. That is a statutory maximum described in the notice—not a sentence, and not evidence that a final charge or conviction had been reached.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How Conti and LockBit fit the case
Conti is the ransomware specifically tied by police to the late-2021 incident. The UK National Cyber Security Centre and National Crime Agency said Conti emerged at the end of 2019 and was the world’s most frequently used ransomware variant by 2022. They assessed LockBit as a leading ransomware threat to the UK and globally after Conti’s demise in mid-2022. Those are dated, group-level assessments; they do not add evidence about this suspect’s individual role. UK government release, May 7, 2024
The same May 2024 release attributed attacks on more than 200 UK businesses and major public-service providers to LockBit, and reported that LockBit accounted for 25% of global ransomware attacks in 2023. Those figures describe the group, not the Ukrainian investigation, and should not be read as a tally of incidents involving the suspect.
Quick Recap
What remains unknown
- The Ukrainian police notice does not name the suspect or the affected company.
- The reviewed accounts do not establish a final charging decision, court outcome, conviction or sentence.
- The April 18, 2024, custody date is reported by Dark Reading as information from Dutch officials; it is not stated in the Ukrainian police notice.
- The police account links the suspect to both groups but describes a specific attack involving Conti malware; it does not allege that he led either operation.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
