Conti ransomware’s inside chats leaked after siding with Russia

A Ukrainian safety researcher has leaked over 60,000 inside messages belonging to the Conti ransomware operation after the gang sided with Russia over the invasion of Ukraine.

BleepingComputer has independently confirmed the validity of those messages from inside conversations beforehand shared with BleepingComputer concerning Conti’s assault on Shutterfly.

AdvIntel CEO Vitali Kremez, who has been monitoring the Conti/TrickBot operation over the past couple of years, additionally confirmed to BleepingComputer that the leaked messages are legitimate and had been taken from a log server for the Jabber communication system utilized by the ransomware gang.

Kremez instructed BleepingComputer that the info was leaked by a researcher who had entry to the “ejabberd database” backend for Conti’s XMPP chat server. This was additionally confirmed by cybersecurity agency Maintain Safety.

In whole, there are 393 leaked JSON information containing a complete of 60,694 messages since January 21, 2021, by way of at the moment. Conti launched their operation in July 2020, so whereas it comprises a giant chunk of their inside conversations, it’s not all of them.

These conversations comprise numerous details about the gang’s actions, together with beforehand unreported victims, non-public knowledge leak URLs, bitcoin addresses, and discussions about their operations.

For instance, the dialog beneath is the Conti members questioning how BleepingComputer realized of their assault on Shutterfly in December.

Kremez additionally shared a snippet of dialog that he discovered discussing how the TrickBot operation was shut down, as we reported final week.

There are additionally conversations about Conti/TrickBot’s Diavol ransomware operation and 239 bitcoin addresses containing $13 million in funds, which had been added to the Ransomwhere web site.

239 Bitcoin addresses representing ~$13.1 million in funds from the Conti leak have been added to https://t.co/lBxHWCQm7S. The total dataset is obtainable to obtain from the location.#ransomware #Conti

— Ransomwhere (@ransomwhere_) February 27, 2022

The leak of those messages is a extreme blow to the ransomware operation, offering delicate intelligence to researchers and legislation enforcement about their inside processes.

Whereas the above snippets are solely a tiny piece of the leaked conversations, we are able to count on to see way more data realized from the info within the coming weeks.

Messages leaked over Conti’s siding with Russia

Earlier this week, the Conti ransomware operation revealed a weblog publish saying their full help for the Russian authorities’s assault on Ukraine. In addition they warned that if anybody organized a cyberattack in opposition to Russia, the Conti gang would strike again at vital infrastructure.

After Ukrainian Conti associates grew upset over the siding with Russia, the Conti gang changed their message with one other one, stating that they “don’t ally with any authorities” and that they “condemn the continued battle.”

Nonetheless, their change of coronary heart got here too late, and a Ukrainian safety researcher who reportedly had entry to Conti’s backend XMPP server emailed BleepingComputer and different journalists tonight with a hyperlink to the leaked knowledge.

The rationale shared as to why they leaked the non-public conversations may be learn beneath:

Here’s a pleasant heads-up that the Conti gang has simply misplaced all their sh*t.  Please know that is true. 

The hyperlink will take you to obtain an 1.tgz file that may be unpacked operating tar -xzvf 1.tgz command in your terminal .
The contents of the primary dump comprise the chat communications (present, as of at the moment and going to the previous) of the Conti Ransomware gang. We promise it is rather fascinating.

There are extra dumps coming , keep tuned.
You possibly can assist the world by penning this as your prime story.

It’s not malware or a joke.
That is being despatched to many journalists and researchers.

Thanks on your help

Glory to Ukraine!

Russia’s invasion of Ukraine has led to hackers, ransomware gangs, and safety researchers choosing sides within the battle.

Whereas some ransomware gangs have sided with Russia, others, like LockBit, are staying impartial.

Then again, Ukraine has requested volunteer researchers and hackers to hitch their “IT Military” to conduct cyberattacks on Russian targets, with many rallying to the decision.

As for Conti, whereas this leak is embarrassing and offers immense perception into their operation, we’re not more likely to see them going away any time quickly. With their current take over of the stealthy BazarBackdoor malware and turning into an precise crime syndicate, they may, sadly, proceed to be a menace.

Correction 2/28/22: This story initially acknowledged an indignant Conti affiliate who leaked the info. BleepingComputer later realized it was leaked by a Ukrainian safety researcher. The article has been up to date to make clear this data.