Conti Ransomware Gang’s Internal Chats Leaked Online After Siding With Russia

Days after the Conti ransomware group broadcasted a pro-Russian message pledging its allegiance to Vladimir Putin’s ongoing invasion of Ukraine, a disgruntled member of the cartel has leaked the syndicate’s internal chats.

The file dump, published by malware research group VX-Underground, is said to contain 13 months of chat logs between affiliates and administrators of the Russia-affiliated ransomware group from January 2021 to February 2022, in a move that’s expected to offer unprecedented insight into the gang’s workings.

The messages confirm the shutdown of the TrickBot botnet last week as well as highlight the Conti group’s close relationship with the TrickBot and Emotet malware gangs, the latter of which was resurrected late last year through TrickBot.

On top of that, the leaker is also believed to have released the source code associated with TrickBot’s command dispatcher and data collector modules, not to mention the ransomware group’s internal documentation.

The volunteer hacking group, in messages shared on its Telegram channel, claimed that several Russian websites and state online portals have been felled by a barrage of DDoS attacks.

The rapidly evolving cyber war appears to have put other groups on alert, what with LockBit ransomware operators posting a neutral message, stating “For us it is just business and we are all apolitical. We are only interested in money for our harmless and useful work.”

Share this article on social media:

Subscribe to Our Newsletter!

Stay on top of cybersecurity risks, evolving threats and industry news.

This field is for validation purposes and should be left unchanged.

Recent News

Featured Services

The Latest Cybersecurity News

From major cyberattacks, newly discovered critical vulnerabilities to recommended best practices, read it here first:

BOOK A MEETING

Enter your Email Address

This field is for validation purposes and should be left unchanged.

* No free email provider (e.g: gmail.com, hotmail.com, etc.)

This site is registered on wpml.org as a development site. Switch to a production site key to remove this banner.