[ad_1]
A Ukrainian researcher continues to deal devastating blows to the Conti ransomware operation, leaking additional inner conversations, in addition to the supply for his or her ransomware, administrative panels, and extra.
It has been fairly a harmful week for Conti after they sided with Russia on the invasion of Ukraine and upset Ukrainian adverts (associates) and a researcher who has been secretly snooping on their operation.
On Sunday, a Ukrainian researcher utilizing the Twitter deal with @ContiLeaks leaked 393 JSON recordsdata containing over 60,000 inner messages taken from the Conti and Ryuk ransomware gang’s personal XMPP chat server.
These conversations had been from January twenty first, 2021, via February twenty seventh, 2022, offering a treasure trove of knowledge on the cybercrime group, resembling bitcoin addresses, how the gang is organized as a enterprise, evading legislation enforcement, how they conduct their assaults, and far more.
On Monday, the researcher stored leaking extra damaging Conti knowledge, together with a further 148 JSON recordsdata containing 107,000 inner messages since June 2020, which is round when the Conti ransomware operation was first launched.
ContiLeaks started releasing extra knowledge all through the evening, together with the supply code for the gang’s administrative panel, the BazarBackdoor API, screenshots of storage servers, and extra.
Nevertheless, part of the leak that obtained folks excited was a password-protected archive containing the supply code for the Conti ransomware encryptor, decryptor, and builder.
Whereas the leaker didn’t share the password publicly, one other researcher quickly cracked it, permitting everybody entry to the supply code for the Conti ransomware malware recordsdata.
If you’re a reverse engineer, the supply code might not present extra info. Nevertheless, the supply code offers huge perception into how the malware works for many who can program in C, however not essentially reverse engineer.
Whereas that is good for safety analysis, the general public availability of this code does have its drawbacks.
As we noticed when the HiddenTear (for “academic causes”) and Babuk ransomware supply code was launched, menace actors shortly coopt the code to launch their very own operations.
With code as tight and clear because the Conti ransomware operation, we should always count on different menace actors to try to launch their very own prison operations utilizing the leaked supply code.
What could also be extra useful, although, is the BazarBackdoor APIs and TrickBot command and management server supply code that was launched, as there isn’t a strategy to entry that data with out accessing the menace actor’s infrastructure.
As for Conti, we must wait and see if this “knowledge breach” has a lot of an affect on their operation.
This has been a major reputational blow for the group that will trigger associates to maneuver to a different ransomware operation.
However, similar to all companies, and there’s no denying Conti is run like a enterprise, knowledge breaches occur on a regular basis.
[ad_2]
