When the hackers get hacked

Blog

When the hackers get hacked:

a blog series unveiling the Conti ransomware family

Or read part 2: dissecting the attack

On 24 February 2022, Russia declared war on Ukraine and started its invasion. Subsequently, many ransomware gangs and other hacking groups started announcing with whom their allegiances lie [1]. 

After expressing their explicit support on 25 February 2022 for the Russian government and threatening to "strike back at an enemy's critical infrastructure", the group operating the Conti ransomware family has faced severe backlash. Not only from cyber security professionals worldwide but also anti-Russian members within their own organisation [2] [3] [4]. A Ukrainian security researcher [5] under the alias ContiLeaks [6] took up digital arms and started leaking internal chats, source files, screenshots, manuals and other files.  We will report on these leaks in a series of blog posts to come. Our goal is to understand better how the ransomware gang operates, who is involved and when, what challenges they face, and how are they organised. As we proceed with our research, we will report on interesting, noteworthy and critical findings from the leaks.  To kick off the blog post series, we describe Conti, present an overview of the typical organisation of ransomware groups internally and present the data that has been leaked so far. 

Who is Conti? 

How are ransomware gangs organized? 

Northwave created a framework on what roles there are inside a ransomware gang based on key insights from dealing with ransomware incidents. As part of our incident response process, we investigate the root cause of such incidents and talk to the actors behind the ransomware attack. From our experiences, we deducted that there are currently seven distinct roles within a ransomware attack. Each role follows from the objective of the attack's specific activities. We would see each of these roles fulfilled by the same actor in the past. However, in recent years, we have seen that more and more actors are specialising in a single role within this model. 

As part of a blog series called Inside the world of ransomware, we wrote a more detailed overview of the different roles within a ransomware attack [12].  We will investigate if the roles identified by Northwave are also identifiable in the leaked documents and describe how the different actors interact. 

Leaked data 

We will add any additional leaks to this list. The list was updated last on 2-3-2022 at 22:00 UTC.  So far, the leaks seem only to contain internal communication of the Conti group. Northwave did not identify any data of her clients yet in the leaks. Of course, Northwave will closely monitor this and update any of her clients if their data becomes apparent in the leaks.