The Conti ransomware The gang was on top of the world. Vast network of cybercriminals blackmailed $180 million from its victims last yeareclipse the income of all others ransomware gang. Then it came back Vladimir Putin’s Invasion of Ukraine. And it all started to fall apart.
Conti’s outburst began with a post on the group’s website, usually dedicated to posting the names of the group’s victims. Hours later Russian troops cross Ukraine border on February 24, Conti offer “full support” for the Russian government and threatens to attack critical infrastructure of anyone who dares launch cyber attacks against Russia.
But while many Conti . members live in Russia, its scope is international. War has divided the group; private, some have bothered against Putin’s invasion. And while the Conti ringleaders tried to retract their claim, it was too late. Damage has been done. Especially since dozens of people with access to Conti’s files and internal chat systems including a Ukrainian cybersecurity researcher hacked into the group. They proceed to expand Conti.
On February 28, a newly created Twitter account named @ContiLeaks went live 60,000 chat messages sent between members of the gang, its source code and scores of internal Conti documents. The scope and scale of the leak was unprecedented; Never before has the day-to-day inner workings of a ransomware group been so exposed. “Glory to Ukraine,” @ContiLeaks tweeted.
The leaked messages, reviewed in-depth by WIRED, provide an unparalleled look into Conti’s operations and expose the ruthless nature of one of the world’s most successful people. ransomware gang. Among their revelations were the sophisticated hierarchy of the group’s business, the personalities of its members, how it evaded law enforcement, and details of the ransomware negotiations.
“We see the gang progressing. We see the gang alive. We see the gang commit crime and change over the course of a few years,” said Alex Holden, who has a company Keep security have been following Conti members for most of the past decade. Holden, who was born in Ukraine but lives in the US, said he knew the cybersecurity researcher leaked the documents but said they remained anonymous for safety reasons.
The Conti ransomware gang operates like any other business around the world. It has many departments, from human resources and administrators to programmers and researchers. It has policies on how hackers should handle their code and shares best practices for keeping team members hidden from law enforcement.
At the head of the business is Stern, who also follows the Demon and acts as the CEO—Conti members refer to Stern as the “big boss.” All Conti members have a pseudonymous username, which is subject to change. Stern regularly pursues people about their work and wants to calculate their time. “Hi, how are you doing, write down the results, success or failure,” Stern wrote in a message to more than 50 Conti members in March 2021.
