On Feb. 25, a notorious ransomware group known as Conti expressed support for Russia as the country invaded Ukraine. It turned out to be a bad idea: days later, a massive trove of the gang’s secrets was leaked.
The data contains details on specific hacking campaigns, Bitcoin wallets used by the gang and ruminations on the future of cryptocurrency as a tool for money laundering. In one chat message, a member of Conti expressed fury that someone associated with their group had targeted a website inside Russia ("Such d---heads," this person called colleagues). Another detailed an attempted hack on a contributor to an investigative journalism outlet probing the suspected poisoning of a prominent Kremlin critic (“Bro don’t forget about Navalny").
The files also divulged the organized-crime equivalent of proprietary secrets: particulars on the gang's use of specific malware tools and insights on their negotiation techniques. Taken together, experts told Bloomberg News, the Conti leak may have done more to expose its members and undermine its methods than investigations by law enforcement and security firms. The files expose the group’s organizational structure and clues about the techniques used to stay ahead of police, which represents valuable intelligence.
