180: Conti

Sponsors and ads

0:00This episode is sponsored by NetSuite. AI isn't just opening new business opportunities. It's changing the way businesses get work done. That's the idea behind NetSuite Next, the next generation of the business management suite trusted by over 44,000 companies with AI woven into every tool you already rely on. NetSuite Next surfaces insights when you need them, puts agents to work on routine tasks and problems. It's the service that I would use if I needed it. And if you want ideas for what else it can do for you, experts have created a business guide called

0:33Aligning for the Agentic Era, how AI is changing everyday work. And right now it's a free download and see how AI could reshape across your organization and how you can prosper from it. If your revenues are at least in the seven figures, go to netsuite.com slash darknet. Get your free guide at netsuite.com slash darknet. Netsuite.com slash darknet. Netsuite.com slash darknet.

The silence of ransomware

1:02There's a kind of silence that follows a ransomware attack. Your throat gets dry, your chest gets a little heavy, and everything around you goes silent. Especially when you see text like this flash across your screen. All of your files are currently encrypted. If you try to ignore us, we've downloaded your data and are ready to publish it. You don't know who's on the other side of that ransomware note, or just how much damage they may cause if you don't pay up. The most fearsome enemy is the one you can't see.

1:33That silence, pulsating fear can be deafening as it creeps across hospitals trying to treat patients, or business owners trying to make payroll, or teachers running a class full of kids. The time is almost over. We need your decision. If we don't receive any reply to this message, we begin publishing your data. Conti is here to prevent any further damages. For years, there was a group that called themselves Conti, and they wreaked havoc across the internet.

2:04Conti is here to prevent any further damages. Hackers operate behind a curtain, known mostly by the destruction they leave behind. We rarely hear or see them. They want to remain covered up in the shadows, under the guise of codes and keystrokes. But what happens when that curtain gets yanked, and suddenly their deepest, darkest secrets are exposed for the whole world to see? Not just their threats against us, but their arguments, their insecurities, and fears. These are true stories from the dark side of the internet.

2:44I'm Jack Recider. This is Darknet Diaries. This episode is sponsored by ThreatLocker. The weird part about modern cyber attacks is how normal they look. The attacker logs in from Chrome, uses PowerShell, runs a remote admin tool your IT team already trusts.

3:18There's no custom malware, no dramatic movie hacker moment, just normal tools used in the wrong way. That's part of why ThreatLocker exists. ThreatLocker helps organizations control what software can run, what it can do, and how systems communicate. If attackers get credentials or land on a machine, they'll have a much harder time moving through the environment. Because security teams are realizing something important, the problem isn't always unknown software anymore. Sometimes it's trusted software being used by the wrong person.

3:48If you want to see how ThreatLocker works, go to ThreatLocker.com slash Darknet and book a demo today. That's ThreatLocker.com slash Darknet to book a demo. This episode is sponsored by my friends over at Maze. GitHub saw nearly a billion commits last year. This year, with AI agents writing code, they're on pace for 14 billion. Code is shipping faster than ever, and its vulnerabilities are piling up just as quickly.

4:21Legacy SCA and SAST tools weren't built for this kind of scale. That's why Maze just launched Maze Code. They're using AI agents to investigate every vulnerability in your dependencies and in the code your team writes. The agents use context from your code and cloud to prove what's really exploitable in your environment, not just theoretically risky. Then they go further, catching the business logic flaws other tools miss. And when something's exploitable, they find the fix and send it straight to the right developer or your coding agent.

4:54Check out Maze at MazeHQ.com slash Darknet. That's Maze, spelled M-A-Z-E. MazeHQ.com slash Darknet.

Origins of the Conti gang

5:05When I think about the lifespan of a Russian cyber gang, there's an image that comes to mind. It's that Russian nesting doll. You know, those wooden dolls that stack together. They stack inside each other. They start small, and then they get bigger and bigger and bigger. Russian hackers kind of operate in the same way. One tiny group starts it. They're at the center. And then they develop more and more layers around them. They get bigger and more influential and can rack up millions of dollars and leave a trail of destruction.

5:35These Russian cyber criminals seem to be untouchable by the Western authorities. The FBI and Europol can't go into Russia to arrest them. But they can issue arrest warrants for them in case they trip up or fly somewhere outside of Russia. They might get arrested. But you might think that when the cyber criminal gets arrested, it's all over, right? Well, not exactly. Like those nesting dolls, when a cyber gang forms an outer shell, it forms into something else. Sometimes something even more sinister. And it keeps happening over and over until there's splintering cells, each one learning from the other, each one working together.

6:10And that's how I think about Conti, one of the most successful ransomware gangs in history. But before I get into Conti, let's back up a bit and take a look at where they came from. Before them were other ransomware groups. There was the Dyer Gang and there was TrickBot. And a central person in both of those was a Russian crime boss who went by the name Bentley. Bentley was an entrepreneur at heart and found creative ways to launder his cybercrime profits. In order to securely access profits from cybercrime, this Bentley character created side hustles to launder his cybercrime profits.

6:43It's a hard problem that hackers have to figure out all the time. How do you turn ransomware payments, stolen credit card data or crypto into something you can buy without leaving a paper trail? It's where the business of illegal hacking meets the real world. And Bentley's big idea was to use his proceeds from the Dyer ransomware gang to create a film production company. I guess his idea was that if he can make a film with dirty money, and then that film makes actual money, then that money is clean.

7:14They were ending up with so much money that they needed some vehicle through which to wash the money. That's Jeff White. He's a good friend of the show. He's an investigative journalist out of London. And he's been reporting on some of the world's most prolific hackers from the U.S. to North Korea to Russia. And he hosts a new BBC podcast on Conti called The Conti Files. Jeff Sets, Bentley's film production company, was called the 25th Floor Film Company, housed in a skyscraper in Moscow. Now, this wasn't just an idea of Bentley's. They were making actual films. Obviously, they have to make some films, because if you can have a front company, it's got to actually do some of the work that the front company is supposed to be doing.

7:50So they thought, well, what films should we make? They worked on some movies and television shows in Russia and surrounding countries. And they also produced action films with A-list American stars. Like there was this movie called Exposed, starring Keanu Reeves, which was made by them. Nobody's talking. I don't blame them. He's dead. He's dead. She's dead. But somebody knows something. And Bentley knew all the ins and outs of the cybercrime underworld. And he had a film production company. And this made him start to think.

8:21And hilariously, they decided they would make a film about a group of Russian computer hackers, which was going to be called Botnet. And this film they were going to make, when I spoke to the screenwriter, a guy called David Kaplan, who was recruited in Hollywood, some Russian guys came up to him at a party and suggested he might like to write this film. And then when he starts researching it, he went over to Russia to meet the film company, not realizing that the very building the film company was based in was also the same building where the hackers were working on this malware.

8:53And they described the plot to him. And they sort of said, well, there's going to be this guy in charge, going to be sort of big ball guy. And there's going to be this smart number two guy. And then there's going to be a glamorous woman. And all of these people were actually real characters, real people in the Dyer gang. You know, Bentley, the guy who went on to become Stern, who went on to run Conti, was going to be one of the characters in the film. And apparently they had a plan that they were going to come across to Hollywood and actually shop this around and try and get some funding for it. So it's just, I can never get over this. In order to launder the profits from cybercrime, they created a film company.

9:26And then we're going to use the film company to make a film about the same cybercrime they were using to make the profits to launder through the film company. I mean, it's just, it's genius in a way, evil genius. A critical rule in the hacker underground is don't dox yourself. It's really rule number one. And if you're doing cybercrime, you've got to use fake names, fake addresses, burner emails, burner phones. You can't trust anyone you're working with because if they know who you are and they get compromised, now suddenly you're compromised too. The best operators in the world are the ones you've never heard of.

9:57Silence is their shield. People in this world who can't resist telling their stories are often the first to get caught. So it's wildly surprising that Bentley and even the people around him in the Dyer gang were thinking about making essentially a documentary about their ransomware gang. But in the end, Bentley never reached his dreams of making his big break with this movie, Botnet. Those dreams came crashing down at the end of 2015. Now, tragic end to the 25th floor film company and indeed to the Dyer gang.

10:29They actually got raided by the Russian authorities. We don't know why. Clearly, they fell foul of the Russian authorities somehow. Off the back of that, out of the ashes of that, emerges a new group. Now, that group, initially called TrickBot, starts to morph as they use ransomware. And the ransomware strain that they use, because there's different types of ransomware, the ransomware strain they use was called Conti. So eventually, the Dyer gang becomes TrickBot and eventually TrickBot's known as Conti. And from then on, they're just known as the Conti gang because they're using Conti ransomware to infect victims.

11:03And now you're starting to see these Russian nesting dolls stacking up, one on top of each other, layers upon layers in the group. And within all these variations of hacking gangs, leaders like Bentley learned how to recruit other members of this growing empire. It's astonishingly astute and driven, an organized group of people.

Recruiting members like Max

11:20And as you say, recruiting was a key part of it. You know, they were able to recruit people through Russian sort of jobseeker sites. They were obviously very cagey about what the operation was. They would say, do you want to join a, you know, a fast-moving startup? And one of those early hires was a Latvian computer programmer who went by the name Max. Now, when I first heard that there's a computer programmer in the Conti gang named Max, the first thought I had was, of course there is. Max is a very popular, classic hacker handle. This guy's probably watched too many hacker movies and he probably wears hoodies and has this computer that's like got LEDs inside the case and stuff.

11:57But actually, this Max is opposite of what I pictured. Max is chatty, middle-aged, and a woman from Latvia. A mom, even. Her actual name is Alavita. She spoke with a journalist and the BBC translated her responses. A long time ago, I graduated from Latvian State University. Max grew up in the 1980s in Soviet Union and managed to pick up coding work in Russia. Max has a degree in applied mathematics and wanted more than anything to become a computer programmer. She got married, had kids, and moved all the way to a tiny country in South America.

12:32There I continued to work with Russians, but it was all uncertain. From one project to the next, I wanted more stability and didn't want to work alone, just my client and I. So she's looking for a job. Computer programming is what she always wanted to do. And she comes across a talent boot camp for coders. I attended this three-day webinar. Your CV kind of goes into circulation and the potential employer can come across it and even reach out with some kind of invitation. Max sends her resume and someone responds to see if she wants to join their company.

13:03She didn't ask a lot of questions about who this company was and she didn't get a lot of information because Max thought that's just how it goes in the land of coders. As part of the job application, she was asked to take a test. So I said that I would take this test. It was quite complicated, but I solved everything and sent them a link so they could see the results. And the week after, they write back to me. She gets the job and starts getting to know her co-workers.

13:33Everyone is remote. Now remember, Max is living in South America, so it feels a bit isolating. There's some water cooler talk over Jabber Messenger, but something feels off. None of her co-workers are using their actual names. Instead, they're using strange nicknames like Professor or Snow White or Adelina. Simple, random nicknames. And then there was one other thing. No one on the team wanted to do a video chat with her. I asked if we wanted to Skype, but they said that they were just chatting.

14:06I like good jokes. That's why I wrote ironically in the mail. Ah, maybe you're the kind of hackers you hear so much about. He answered me. No, we are not hackers. But soon enough, she learns the truth. Her boss gives her a link to a page that had some wording on it. She's told to use what was on the site as a template for other sites. And that's all she knows. The page loads. She sees the gears turning, turning. Max stares at her screen. Scrolling text comes across it. And it starts to come into focus.

14:38There was text. Your computer is infected. Blah, blah, blah. So pay money. It's a template for a ransomware note. This was the first time Max realized she's not just a computer programmer for some tech company. She's a programmer for a cyber criminal enterprise. Where at the center was Bentley, who had pieced it all together from the rubble of the 25th floor film company. This is the moment where Max goes from being an innocent computer programmer to knowingly being part of an international cybercrime syndicate, which has to be some decision, right?

15:13Like, when you realize you're infecting the world with ransomware, do you say, oh, no, that's against my ethics? Or do you just shrug your shoulders and say, you know what? It's a good pay. Why not? At that point, she decides to stick with it. And actually, at that point, she's living very far away from home. She's living actually in Suriname in South America. I think she felt like she was very far away from any risks maybe there. She felt she was just working. By this point, she realized she's working for a ransomware gang. But I think she felt quite insulated.

15:44And also felt that her role was fairly junior within this. It's a classic thing where I think she justified it to herself of, well, you know, I'm not really doing any hacking. I'm just doing some coding for them. Over the years, Max became a bigger and bigger part of the ransomware operations. While her focus is web design and web development, investigators said because of her language skills, she was able to help write ransomware notes. Now, Max wasn't massively great at operational security because she ended up hosting some of the Conti ransomware code, apparently, on her own website in her own name.

16:18A la Vita is her name. And had also done some YouTube videos at the time, so was also identifiable from those. It could be that her security was rubbish, or it could be that she just didn't realize how at risk she was. This was the early stages of the Conti ransomware group forming. And they had already began infecting systems and getting paid when somebody wanted the decryption key, which, of course, was starting to draw attention of the U.S. authorities. They began investigating who was behind Conti, which led them to Max.

16:48And soon they discovered her real name was a la Vita. And they found that she was living in South America. They found out that she actually overstayed her visa while in South America. And so the U.S. authorities worked with the local authorities there to find her and get them to fly her home to Russia because she overstayed her visa. But they purposely put her on a flight to Miami to make her connection to Russia. And when she landed in Miami, she was arrested by U.S. authorities. This was the first person to go down in the Conti group.

17:21They were charging her with her involvement with TrickBot and Conti. At this point, TrickBot was working closely with the Conti ransomware gang. And soon they would merge together. Conti was going to acquire TrickBot. And Conti ransomware was becoming sort of a service where you could be an affiliate of theirs. You could use the Conti ransomware to infect a network somewhere. And then once infected, the Conti team would then take it from there, negotiating payment, handing over decryption keys, etc. And then the affiliate would get a cut of it.

Attacking Ireland's hospital network

17:50A few months after Max's arrest, hackers using the Conti ransomware launched a devastating attack that put Conti on the map of the world stage.

18:04In the early days of the pandemic, someone burrowed their way deep into Ireland's hospital network. The initial intrusion happened when a hospital employee opened a phishing email containing a malicious Microsoft Excel attachment. They clicked it. They clicked it. They opened it. They got infected. That was patient zero. Attackers got in and opened up a back door so they could stay in. And then they began making that infection spread.

18:34Dozens of infected machines became hundreds. One infected hospital became two, which quickly spread to ten. Thousands of machines were infected and the infection kept spreading across clinics and offices and more hospitals. Thousands of machines were hit with this ransomware. In total, over 70,000 computers were infected at 4,000 locations. And over 40 hospitals were infected within the Ireland's hospital network. And it just sat there, quiet, waiting for the right moment to lock up all the computers.

19:14I sometimes liken it to being a burglar. You know, you break into a house, it's dark. You've no idea the layout of the house. And so you just have to kind of keep opening doors. And you hope that the door you open isn't the one into the bedroom where, you know, the people who own the house are there with a gun. There is a long process of scoping it out. And of course, at any moment you might get caught, you know, your access might be revealed. And after weeks of lurking in the network's shadows, the hackers struck. Ireland's health service describing this as a significant ransomware attack.

19:46People asking how an attack like this could have happened in the first place. There's no doubt it is a vicious and a callous act and will be condemned everywhere by decent people. It was total pandemonium. Ireland's health care system was hit with the most devastating ransomware attack they had ever seen by a Russian-based cybercrime gang called Conti. Every hospital in the Irish network felt Conti's attack. To keep track of patient appointments and records, clinicians just had to use pen and paper like the old days.

20:18The attack disrupted COVID and blood work tests. All this as Ireland was in its third wave of the COVID pandemic. It's longest lockdown yet. This is the middle of a pandemic. And as you say, people in Ireland, they speak their minds, the Irish, and they absolutely hated this. Why would people attack our health service? And particularly during the middle of a pandemic. Maternity wards and pediatric units were thrown into chaos. This is basically an entire country's hospital system being held to ransom in one go. Absolutely stunning. It was unlike anything that they, well, actually we've ever seen before.

20:51The information systems behind all these hospitals went into a tailspin, a total scramble. Health services classically do not prioritize IT security because they've got lots of other things to prioritize. And they generally don't think that they're going to be a target for hackers. They haven't been historically. And those patients ended up paying a big price. One person who Jeff actually talked to, who lived in Dublin, went through a particularly awful cancer treatment, a brain cancer treatment. But when the cyber attack happened, she was getting ready for a highly targeted cancer treatment involving lasers zapping the cancer in these precise spots.

21:26But with computers down, the doctors had to cancel her appointment. So she had to wait even longer to get her cancer irradiated. Stories like these began to flood through Ireland's hospitals. It was pure chaos. And of course, the Conti group was messaging the hospital saying, there's one thing that can make this stop. Money. Just about every hospital in the network got a ransomware note saying, we have ransomwared your data. If you want to contact us and negotiate, here is the way you do it. The hackers demanded $20 million to bring back up the hospital's computers.

22:00To make matters worse, the Conti gang said they had stolen over 700 gigabytes of data, like patient and payroll records. They were saying, if you want us to delete it, you have to pay. Now imagine, you're the one in the Ireland Health Department that has to make the call on what to do next. You came into work and you found every screen in the building displaying the same ransomware message. Everyone's files are encrypted. All the computers are down. Your backups are gone.

22:31People's lives are literally on the line. And at the bottom, a countdown and a price. Ireland's response? No, we are not going to pay a ransom. Forget it. The executives for the Irish Health Service kept in contact with the Conti gang, though. I think they were negotiating the price down. But I also think they were just trying to buy some time so that they don't publish the data yet. There was some back and forth between the two of them, while the Ireland Health System tried desperately to get their systems back up and running all on their own.

23:02They're desperately trying to work out, how can we decrypt this data without paying the ransom? How can we get hospitals back on their feet? Which are the most important hospitals, you know? And you've got to make some hard decisions there, Jack, right? You know, is children's health more important than older persons' health? Do you prioritize cancer or do you prioritize other diseases? You know, these are the kind of decisions they're having to make. They're literally life or death decisions about where you try and apply the help first. There was a calculation apparently made at the rate they were able to decrypt the data, how long it would have taken to decrypt all of it without the ransomware key, the decryption key.

23:34And it was in the years, one or two years, to unscramble it all. So you're facing these problems month after month, potentially year after year. So the hackers kept going. And of course, at this point, you know, frankly, you may as well. You scramble all the data. You're kind of in for a penny, in for a pound, or in for several tens of millions in this case. There was a period of several weeks where all of this was going on. The data was scrambled. Hospitals were really struggling. The hospitals were getting by. You know, the health professionals, they can get back some test results, but it's a fraction of what they get.

24:10And they can continue treatment with some people. But after weeks, the hacker had a surprising change of heart. Out of nowhere, without having paid the ransom, they gave the decryption key over to Ireland and seemingly just left the hospital alone after that. It's still a mystery as to why, but there are some running theories. One theory is that there's a Russian embassy in Ireland, and it condemned the attack, even agreeing to support Ireland as it recovered. So the hackers handed over the decryption key so hospitals could recover, but their attacks continued against other places in Ireland.

24:43They infected school districts, city government, and businesses. Their demands were always the same. Pay up to decrypt your computers, or else we release your data on the dark web. Just in case if you try to ignore us, we've downloaded your data and are ready to publish it if you do not respond. So it will be better for both sites if you contact us as soon as possible.

Double-dip ransomware and Graff

25:06One of their targets in 2021 was this jewelry company called Graff. It's in the UK and known as the jeweler of the stars. Its clients include Donald Trump, Oprah Winfrey, and David Beckham. But the client list is never revealed publicly by Graff. It's actually super secret. They are extremely tight-lipped about who their clients are. But in 2021, Conti broke into the jewelry store digitally and stole a list of all of Graff's clients.

25:36This, of course, made Graff panic, and they were extremely upset. The names and phone numbers of all their high-end customers has been stolen and in the hands of some cyber criminals? Forget about the computers being encrypted. The stolen data was more of a problem now. Conti wasn't messing around. When Graff didn't pay right away, they wanted to show them they were serious. So they took a chunk of this customer data and released it. 70,000 Graff documents hit the dark web. The solution to ransomware was pretty easy.

26:08Backup your data. Because if it's scrambled, you can just wipe the computer, reinstall the data from backup, and jog on and not pay the ransom. Of course, the ransomware gangs saw that, saw it as a threat to their business, which it was, and invented the idea of what they call double-dip ransomware. Double-dip ransomware. Essentially a cyber attack with two steps. Steal sensitive corporate data before encrypting it. It gives the hackers more leverage. Conti demanded the jeweler pay tens of millions of dollars to decrypt its systems and to prevent more information from getting out on the dark web.

26:41So instead of just scrambling the data, we will steal a chunk of the data and then scramble the data. And if the victim refuses to pay because they've got backups of their data, we can say, ha-ha, if you don't pay, we will leak this sensitive data. It's exactly what happened to Graff. So with Conti, it wasn't the full leak. It would have been, you know, a few hundred pages maybe of data. But in there would have been the data of very high-profile clients. And my guess is that Conti scanned the information and thought, oh, look, some famous people here.

27:12We'll stick this online as a sort of threat to the Graff group and say, look, if you don't pay the ransom, there's going to be more of this. But Conti didn't look really carefully through the data they were leaking. It was actually too much data for the Conti gang to analyze effectively. In the end, Graff did pay up. They paid seven and a half million dollars in Bitcoin. They didn't want the rest of their client list getting out. And they felt like this was the price they have to pay to keep their customers' records secret. But how much can you even trust this Conti group to be good on their word when they say they'll actually delete it?

27:46It must have been so maddening for Graff. But Conti's successful jewelry heist may have been rushed, even sloppy. We all make mistakes when we're rushing. And Conti is no different. Within the initial breach of customer data leaked on the dark web, Conti unwittingly shared details of purchases of high-profile members of society. And one of those was the Saudi royal family. That's right. Conti doxxed the Saudi royal family.

28:18And that did not go down well, it seems, among the Saudi royal family. There are people around the world who you want to offend and people who you really, really don't. And the Saudis are probably very much in the latter category. After the UK's Daily Mail reported on this heist, The Conti gang must have been contacted by someone or threatened or something serious happened because Conti published an apology. Something you never see from cybercriminals. We found that our sample data was not properly reviewed before being uploaded to the blog.

28:51Conti guarantees that any information pertaining to the members of Saudi Arabia, UAE, and Qatar families will be deleted without any exposure and review. Our team apologizes to His Royal Highness Prince Mohammed bin Salman and any other members of the royal family whose names were mentioned in the publication for any inconvenience. Conti said it removed the documents from Graph that had initially leaked online and claimed none of the stolen data was sold on auctions or offered as samples or revealed in any other capacity to any third party.

29:24Conti guarantees to implement a more rigid data review process for any future operations. Wow, that's really unusual that they retracted their leak. My head starts to go to, okay, somebody had enough wealth and influence to be able to say, okay, let's find out who these people were and go and personally threaten them. Yes. Yes, there was an expert we interviewed for the podcast, intelligence expert. His assessment of this was that the kinds of wealth you're talking about and the kinds of people involved in those leaks.

30:01You're talking about the top strata of the world's richest, most powerful people. They have a cadre of people around them who look after their security and look after their interests.

30:12Those people are very good at their jobs and will make it absolutely clear to a gang like Conti, you have done this. There are going to be consequences for you. We have ways of finding you. And if we find you, you're in a lot of trouble and potentially a lot of danger. So there would have been an intimidation of Conti to say, take this data down or else. You're not playing here with low players. You're playing with serious people. Now, as I say, we do not know, we're not privy to those emails because they would have been sent and received by, you know, the security teams behind these powerful people.

30:47But as I say, the proof of the pudding is in the eating. We know that Conti issued an apology and we know within the internal conversations within Conti that they absolutely freaked out when this happened and were very worried. In fact, one of the quotes in the Conti gang was, they'll find you and you're gone. So we know that Conti worried internally. We know that publicly they were apologizing. If you join the dots, it does really look like somebody got to Conti and said, take it down or else.

31:18Wow, that's really surprising to me. I imagine these ransomware groups to be always getting threats from people, right? Just like, I will find you and I will take your children or dog or something. And they just like watching the world burn. So it's just a surprise to see them be threatened in such a way, be scared in some way, that they issue an apology and redact their leak. They must have been really spooked. And they were on such a roll, too. In 2021 alone, they collected over $180 million from their ransomware operations.

31:50But I guess Conti was getting their first taste of flying too close to the sun. We're going to take a quick ad break here. But stay with us, because when we come back, these nesting dolls are going to come apart in the most dramatic way possible.

Infiltrating the gang's infrastructure

32:02This episode is sponsored by Doppel. Protecting yourself from attackers used to be as simple as deleting dodgy-looking emails. But with AI, the attack surface has outgrown the defense that legacy vendors provide. Doppel was founded in 2022 to give companies back control. Doppel is an AI-native social engineering defense platform. Doppel strengthens human risk management by training employees to recognize deception

32:33and provides digital risk protection across every channel. It even delivers agentic email security that doesn't just score the inbox, but takes down the attacker infrastructure behind the message. Those dodgy-looking emails have been replaced by bespoke and personalized texts, URLs, ads, and even social media connections. But Doppel can then turn these attacks your business receives to inform campaigns and security awareness training for your employees so that they know what to look out for. Doppel. Outpacing what's next in social engineering.

33:06Learn more at doppel.com. That's spelled D-O-P-P-E-L. Doppel.com.

33:14Imagine this. Two Russian hackers are having a conversation. One of them is planning a major attack against, I don't know, a hospital, let's say. And the other is in disguise, posing as a Russian hacker. And he's really trying to thwart that attack. The conversations are happening over a dark web forum or on Jabber or Rocket Chat. And sure, conversations with a Russian hacker might start lights, like talking about fishing or visiting St. Petersburg's art museums.

33:45But then they'll take a turn, shifting to actual criminal secrets. Just imagine, if you could get a hacker to be vulnerable when their guard is down, what kind of intel could you get about targets or methodologies for attack? Could you turn them away from cybercrime? We find fascinating things on the dark web. We engage with the bad guys. We get inside of not only their systems, but inside their heads. This is Alex Holden. He's a Ukrainian cybersecurity researcher now living in the U.S. And he runs a company called Hold Security based in Milwaukee.

34:18Years ago, him and his team of analysts began infiltrating members of TrickBot, which would go on to get acquired by Conti. Alex and his team talked with TrickBot members, pretending to be black hat hackers, trying to gain their trust. They weren't buying or selling anything, because that is illegal. But they were on a top-secret mission to make connections. And that's what Alex does with ransomware gangs, nation-state threat actors or hacktivist movements. You would be surprised, but the bad guys on the dark web, a lot of them need to talk to somebody.

34:49They need a friend. And we create this friend environment for them to start spilling their deepest and darkest secrets. So they're getting some of TrickBot's deepest and darkest secrets through its members. They even applied for jobs at TrickBot and tried to move up the chain. And they developed relationships with the members to learn more and maybe even turn them good. And we also meddled with some of their perceptions, opinions, even building paranoia for some of them, saying that law enforcement is coming for you.

35:20And after a while of chumming it up with TrickBot, Alex caught a big break. So one guy, part of TrickBot, decided to give his girlfriend as a present access to TrickBot. So this is not a top present that guys give to their girlfriends, but he gave access so she can go shopping. So he showed how to find credit cards, how to take virtual machines, stuff like that. And through a folly of errors, because we had visibility into her communications

35:51that she did not believe in encryption or good passwords or anything like that, she basically disclosed all of it. So that was one of the main advantage points for a while. But over time, we started looking at this and say, okay, here's access to a job or server. Because this girl was given an account and the password was 123456. And that's what the admin gave her. But his password just had like an A at the end after 123456.

36:22Alex's team whittled their way into TrickBot's infrastructure, scraping chat logs and eventually cloning the network. And while continuing to make connections with some of the big players in the TrickBot echelon. You'll build a friendship with some of the people, including with Stern. Ah, yes, Stern. Remember I told you about that guy Bentley before? He was the one who ran the Dyer ransomware gang. And then he started the 25th floor film company. And then he started the TrickBot ransomware gang, which morphed into the Conti ransomware gang.

36:53Well, when it morphed into Conti, he morphed from Bentley to Stern. But at the time, we didn't know who this Stern guy was. We only knew that he was one of the nesting dolls at the center of Conti. At some point, Stern wants to build his own crypto mining platform. And there was conversation, like 30, 40 pages of conversation about that. But this is like, you know, the idea is to sway it from cybercrime to a social angle.

37:24Trying to limit Stern's damage. There are a lot of moving parts here. A lot of sleepless nights where Alex and his team was glued to chat logs, reading chat forums. They watched TrickBot starting in 2019 and continued as TrickBot got acquired by Conti two years later. His team obtained hundreds of thousands of messages. They curated the data, they read through it, and published summaries of the data. And what they saw was a criminal enterprise, a lot more organized than any of them even imagined.

37:55TrickBot was run by Stern as a company. It was not run as a gang. And, you know, I'm very used to corporate America. That's the look I had right now, but the company that they run, they had different departments. They had physical offices. They had lunches. They talked to each other. They were sympathetic to employees like Alavita, who got in trouble. Alavita is the TrickBot member I told you about earlier who was arrested.

38:26She went by Max, remember? They even said that they are allocating $25 billion in the first eight months of 2021, I believe, to improve their infrastructure. Not every company can afford that much of expansion. They did. So it was budgeting. It was new accounting. It was everything. Alex's team also got insight into attacks that were still in the planning stages, attacks against schools, city governments, and hospitals.

38:59Here's one Conti member named Target writing about going after health care. We got on a video call with them. They offered 18 Bitcoin. Their turnover is 30 million. Let them pay millions. Tomorrow, we'll make a move that'll make the whole leadership go, please, miss, don't do it. They got used to little old chats and messages over there. 18 Bitcoin. Heh. Tomorrow, the whole office will rob them. Let them die.

39:29Despite this being criminal activity, there are still certain rules that criminal hackers have. Ask enough people in the ransomware underground, and you'll hear that there are certain targets that are just off limits, like hospitals. After the Russian hacking group Lockbit targeted a children's hospital in Canada in 2023, it publicly apologized and turned over the decryption key. It didn't know it was a hospital. In the Conti chat logs, you can see internal disagreements about the ethics of going after health care.

40:00For example, one Conti member asks the Conti boss, Stern, if he signed off on encrypting the hospital's data. And Stern responds with, I usually don't approve encryptions. If you didn't approve it, I will hand the decryptor to that clinic. We agreed not to touch the medical sector. Remember? This Conti member, who's pushing back against going after hospitals, messages Stern, complaining about their co-worker, someone who goes by the name Dollar. Let's get Dollar out of the game. He's a total idiot. Back then, he screwed me over, claiming he had an agreement with you

40:31to mess with the hospital. And now, he targeted the hospital again. That's disrespectful. I told him twice that we don't touch the medical sector.

40:42At this point, Conti's members and affiliates were in the hundreds. And as it grew, it became more challenging to control hacking operations. So it's no surprise you'd get these internal riffs about who to attack. And to make matters worse, Conti was without leadership. The boss, Stern, drifted away from the chat logs. He was just not present very much anymore. My theory is that when you start a new and upcoming cybercrime group, it's exciting. It's fun. But then when things start turning into just handling customer support issues

41:12all day long, leaders often lose interest. One of his deputies, someone who went by the name Mingo, got growingly frustrated about this. You constantly give me the impression that you don't care. You need to be online more often and in some situations, be a bit tougher for disciplinary purposes. And then by January 2022, researcher Alex Holden says, Stern left Conti without a trace. The chat logs just show Conti falling into chaos after that. Listen, Stern has gone missing.

41:43No, he's not missing. He'll show up soon. Everyone's looking for him. With the boss gone, people started getting worried if anyone was going to get paid. Members weren't quite panicking yet, but it felt like the ground was becoming unstable within Conti. And then, to everyone's surprise,

The war in Ukraine splits Conti

42:00a full-blown war erupted.

42:06It was unprovoked, but this is what Russian President Vladimir Putin unleashed on Ukraine. As the sun came up this morning, a missile striking an industrial park in western Ukraine, a helicopter assault on an airport outside of Kiev, close, intense fighting, and there are civilian casualties. Little did we know that Russia invading Ukraine was going to send a shockwave through Conti.

42:36Many of the members were glued to the news. I hope that Kiev will be ours by evening. But not everyone in Conti was rooting for Russia. Many of Conti members were from Ukraine. The war split a lot of families because some families were living in both Ukraine and Russia, and suddenly they were at war with each other. The war completely split the Conti pack, with some of its operators really unhappy about this invasion. Friends, brothers, are there any Ukrainians besides me? Madness.

43:07Support me, brothers. I mean, I'm just thinking about how can you be thick as thieves with someone and go rob the world of millions of dollars doing cybercrime together and then suddenly go to war with the very people in your own group? Members were torn about what to do. Talking to you directly, your posts are painful for the members of our team. Emotions and tensions started flaring up in the group chats. Half the Conti gang were saying, Kiev by dawn, and the other half were saying,

43:37Slava, Ukraine. And eventually, Conti, as an organization, took a stand, releasing a statement for the world to see. The Conti team is officially announcing full support of the Russian government. If anybody decides to organize a cyber attack or any war activities against Russia, we are going to use all our possible resources to strike back at the critical infrastructures of an enemy. When that message showed up on computer screens across the world, there was someone who took this note

44:08very seriously. He was an IT specialist from Ukraine. And this message consumed him with anger. I cannot shoot anything, but I can fight with a keyboard and mouse. In an interview at the time, he told CNN he was prepared to cut deep into Conti where it hurt. We had someone voice his responses. It's my country. If the Ukrainian government provides me weapons, okay, I'll go fight. But I'm better at typing.

44:38This Ukrainian IT specialist had a plan. He wanted to do a data breach on the Conti ransomware gang itself. He thought if he could get into their internal communications, download all their chat logs, see what their network consists of, look at their member information, he could expose them in a very devastating way. He started working with Alex Holden and others to try to obtain the Conti chat logs. He was grabbing the chat logs while other members of the team were reading through them

45:08and providing summaries. These messages were private in the Conti network. They were never meant to be released. But he was determined to expose them, to ruin Conti. He came to Alex and told him what his plan was. He talked to me ahead of time. We talked about how to do this properly and it turned out the way it did. I had no control over it.

45:38I did tell him that he needs to think about it. But from a legal perspective, it was not our data. And from moral perspective, I'm also from Ukraine and I completely understand him and his actions. You have to understand that in the first days of the Russian invasion into Ukraine, Conti stated that they fully support the cause

46:09of Putin.

46:13And my friend as a Ukrainian, Ukrainian citizen, Ukrainian national, felt that this is his way not to pick up a weapon and defend his homeland, but something to do bigger against the aggression from Russians.

Leaking internal chat logs

46:36Then, about a week after the invasion, the Ukrainian analyst had infiltrated Conti deep enough and gathered enough incriminating data that he thought it was time to start leaking the data. He created a Twitter account called At Conti Leaks, which it's very ironic to breach and expose a company who's in the very business of breaching and exposing companies, right? Here's what the first tweet said. Greetings. Here is a friendly heads up that the Conti gang has just lost all their shit. Please know this is true.

47:06Now, there's been speculation from researchers and journalists that the leaker may have been a disgruntled former Conti member. The truth is we aren't exactly sure who the leaker is. But Alex Holden says he knows. He says the Conti leaker is a computer specialist who at the time of the leaks

47:25continues to live in Ukraine today. Regardless of who he is, he released the holy grail for cyber security analysts, researchers and journalists who were studying this gang. The contents of the first dump contain the chat communications current as of today and going to the past of the Conti ransomware gang. We promise it is very interesting. There are more dumps coming. Stay tuned. Thank you for your support. Glory to Ukraine.

47:56Over several data dumps, there were tens of thousands of internal messages released. There were conversations about planning attacks, names of members, pictures of members, and details about the organization structure of Conti, which was surprisingly hiding in plain sight. But there were also nuggets that were meant to strike deep into Conti where it hurt. Like the cryptocurrency accounts used to steal millions of dollars in ransomware payments. Or discussions

48:24the Russian opposition leader Alexi Navalny. Alex Holden says before the logs were released, there was information excluded for safety reasons. But he says nothing was altered. My goal in cyber threat intelligence is to help victims as effectively as possible. So he did what he did and he changed the world. We changed the world one victim at a time. He did something better. Because in this situation,

48:54Conti was a victim of a data breach. So this whole thing is like flipped on its ear. I don't think we've ever seen a data breach like this before where the hackers got hacked. I don't think it was the right thing to do.

49:10Conti shuttered in many different groups and the members became part of many other ransomware groups that start multiplying the crime and losing visibility actually increased number of victims. Alex Holden says even though he wouldn't have publicly released the logs, the disclosure changed the Conti gang in profound ways. How many trick bot and Conti operatives been unmasked since? How many of them were indicted?

49:41How many of them are on wanted lists for us from law enforcement perspective?

49:48I remember when these leaks came out. It was quite a moment if you were on Twitter at the time. We all got our popcorn out and was just watching this cyber gang unravel in real time. The nesting dolls just kept opening one after another and we had no idea how many would just keep opening. It was just wild to see one open after another. People were being exposed left and right. There were pictures of the Conti gang going around. Soon there were memes about the members. Like surprisingly there was a half dozen women who were members of the Conti gang. And so you'd see posts like

50:18these are the women of the Conti ransomware gang and lots of photos were shown of just them driving in cars eating lunches passports photos of them many of them were looking like they were part of the world of luxury. It felt like the lid of this shadowy dark underworld just blew off in an instant. It was such a rare glimpse into one of the most successful ransomware groups of all time. Twitter was having a field day. This wasn't your typical white paper write-up on some ransomware group. This had drama. This had intrigue.

50:49This had dirt and scandals. And I even posted a meme which said

51:00catastrophic is going to happen soon. A lot of us were just sitting back in our chairs like wow season one of this show is amazing. Investigative reporter Jeff White grabbed a front row seat. When this came out I think there was all this stuff about cyber attacks around Ukraine trying to keep abreast of all of that. Then these Conti leaks come out. It's 70,000 messages Jack. It was an absolute nightmare. They're all in Russian. They're in Cyrillic characters. They're in hacker slang. So you've got to try and start translating them.

51:30And then immediately afterwards you get this second huge dump information. It's even more messages. You read 47,000 of these messages? Yes. Yes. I did. Amazing. The thing about the leaks is it's thousands of messages. They're all in Russian. They're all in Cyrillic characters. And

51:51do the work. LLMs do not deal well with Cyrillic alphabet. So there's loads of mistranslations. So one of the things they keep talking about in the leaks is the cubals. Who's got the cubals? Like snooker or pool or you know. And I couldn't understand this and then I realized that if you take the Russian translation of Bitcoin but the N at the end because it's in

52:21it means they're talking about Bitcoin. So immediately you start to kind of understand there's a code almost in the translations. The other thing they kept talking about was the toad as in like the reptile like why is the toad slow and I've got problems with the toad and I couldn't understand why they kept talking about the toad and it turns out the software they were using to communicate was jabber which in Russian is chaber and chaber translates as toad so they keep talking about the toad and you realize they're talking about the jabber thing being slow

52:51so as you're reading through these messages you have to go through them by eye I think one by one because only then you get the hang of what is actually being discussed okay so after the leaks came out and we start to see the inner workings of how this Conti ransomware gang is operating do they skitter do they run away do they hide shut up shop or what happens to them so in terms of what happened next to Conti we know that the gang apparently

53:22disbanded and we know that there was talk in the chats of well you know it's coming to an end just go off

Targeting Costa Rica's government

53:36Conti just became affiliates for other gangs there's some suggestion that Conti members set up other ransomware groups as crossovers with code and so on so the thing splinters and it fractures but there's this amazing moment where they decide someone somewhere within Conti decides they're going to go for one last big takedown and they're just going to do an absolute show stopper and that's when they decide they're going to hit an entire country they're going to hit the government of Costa Rica late today we learned that Costa Rica has declared a state of emergency after a

54:07ransomware attack sounds very serious yeah Costa Rica declared they're at war with Conti how about that nobody was expecting this as the next step from

54:38Conti especially after they just got exposed about two dozen different government organizations were targeted and many sectors came to a screeching halt this was a big deal for Costa Rica the first thing that was hit was Costa Rica's treasury one of the big ramifications of that was importing and exporting of goods and all that's run digitally so that just collapsed and they had to go back to pen and paper but Costa Rica was not ready for that a large chunk of the country's money just

55:09salaries and pensions for government workers in the end the solution they came up with was anybody who got a pension last month gets another pension this month you know just pay people again and hope we sort it out later so they did manage to get around that there was also political consequences this attack happened right in between a change of presidential administrations and it fed into the whole campaign against the existing government like of course they're incompetent they couldn't stop this cyber attack it sort of fed into this sense of you know a country that was kind of on the edge as the

55:40government started looking at this and refused to pay Conti Conti upped the ante and attacked more parts of the government more government departments I think the science and technology department got attacked and in the end there was various local government websites that got taken down as I said you've got this pylon effect where other gangs and other cyber criminals started to get involved and the Conti government was in the end fighting fires probably in the dozens of attacks some much bigger like the treasury and so on some much smaller in terms of local government institutions

56:11but it really was pandemonium and happened at this time of a transfer in government when Costa Rica was particularly vulnerable The incoming president treated this like it was a national emergency and like a wildfire the vulnerability spread across government organizations some systems were infected through phishing emails while for others malware was just put right on them right from the internet and something became clear maybe this wasn't just Conti As the attack went on other cybercrime groups other ransomware groups emerged and also

56:42started attacking Costa Rica so it was kind of a pile-on so Conti were there definitely but the effects of the Conti gang got amplified as the attack unfolded over weeks in Costa Rica I don't know if it matters or not but we don't know if it was the Conti ransomware gang that actually picked their targets or if it was their affiliates that picked the targets or a mix of both precisely I mean Conti had so many affiliates by this point and those affiliates would of course all have had access to

57:13the encryption software the ransomware software and so even if the central core Conti group dissolved it strikes me as possible certainly technically that somebody could have retained that encryption software and if they're an affiliate and are good at getting it into a network and infecting a network there's no reason why they couldn't have used the Conti ransomware without the core Conti gang being aware of it approving it or even still being in existence this could have been an entirely single affiliate led job I think from my technical understanding that's

57:44certainly possible another possibility Jeff says that this was a former member of Conti that was just flexing their muscles saying hey I came from Conti and I did the Costa Rica attack imagine what else I can do and we know for sure that Costa Rica got hit by Conti ransomware but that was the last incident we ever saw of the Conti ransomware because after that arrests started happening certain low-level members of Conti and Trickbot were getting nabbed Conti seemed to be done too much

58:14had been exposed the war tore the members apart and Stern their leader was still missing from daily operations but the affiliates that were helping spread the Conti ransomware many of them probably just joined other groups there were loads of other gangs recruiting if you say look I was with the Conti gang I managed to get a couple of high profile targets you know can I work with your ransomware as an affiliate you like to get a job elsewhere in terms of the core Conti gang we don't

58:45know what happened with them the suspicion is they went on and formed other groups the fact is many of the Conti members who appeared in the logs we don't know who they really were or what happened to them it's because a lot of them used fake names and were based in Russia so it's just really hard to trace but

Identifying leader Vitaly Kovalev

59:00one high ranking person within Conti we do know it's Stern the trick bot commander who was in charge when Conti absorbed trick bot German police and international prosecutors identified Stern as Vitaly Kovalev a Russian national in his late 30s the European Union UK and the US all sanctioned him linking him back to trick bot and Conti a multinational response that essentially tries to freeze him off from the global economy he's going to have a hard time using any service that changes his money into dollars or euros

59:31he likely can't travel to any country that has an extradition treaty with the US Vitaly allegedly racked in more than 300 million dollars and ransomware payments and that's just his own personal cut of the proceeds but given how long he's been at it Jeff White says it's possible that he might be a cybercrime billionaire which would be the first person to become a billionaire from cybercrime Vitaly isn't someone that you would look at and say oh yeah that's a successful cybercrime boss right there

1:00:01if you look him up online you can see his face and he doesn't look suspicious he doesn't have a hood or coverings he's smiling looking cheery he's like the kind of person that if you were lost on the street you would stop and ask for directions and say hello you know frankly you don't look at pictures of and think you know internet gangster number one now I don't know how many of the people you've investigated Jack who you would think that about but he really just doesn't seem the type which is odd for me to be saying as an investigative journalist normally I look at people and go yeah I can see you

1:00:33doing this but Kovalev somehow not of course the big problem Vitaly Kovalev has got if indeed he is stern and did run the Conti gang is what to do with all that money because you'll know I mean again you've done stories in this you know Bitcoin if you've made money in Bitcoin you've got a big problem in that it's traceable you know the big problem I suspect now for members of the Conti gang is where to launder that money and actually what we turned up as part of the podcast was a sort of whole slew

1:01:03of kind of Middle East based often Dubai based cryptocurrency type operations that people were saying were

1:01:14like the Conti gang and some of the individuals behind that interestingly around the Ukraine war there was kind of an exodus of Russians towards Dubai and towards the Middle East Conti's rise is both astonishing and tragic it became the apex predator in the cyber crime world its tactics evolved and that turned into a cash cow and it became so big that it spawned a network of affiliates who went

1:01:44famous and scary until it became too large to last a victim of its own success

Credits and final notes

1:01:51thank you so much to my guests Alex Holden and Jeff White Jeff actually has a multi-part podcast called The Conti Files by Cyberhack which goes into so much more detail about this Conti story he interviewed some really interesting people and it's worth listening to that hey I just released a whole new podcast it's called low and it is out and available for everyone to go listen to right now for free just search your favorite podcast player for low or go to this is low.com to find it this is a story that is so long and twisted that I felt deserved its own podcast it stands on its own as something truly special at least I think so and the feedback

1:02:38I've gotten so far is that it is mind blowing it'll make you think differently about your life and a lot of people say it should absolutely be a movie I've never put so much effort into a story before it took like seven years for me to get this out so go listen to low now thank you this episode was created by me Sir Loin Jack Recyder the ping repeater himself Sean Powers is who wrote and produced this one our editor is the ransom werewolf Tristan Ledger mixing done by Proximity Sound and our intro music is by the mysterious Breakmaster Cylinder

1:03:11my ransomware negotiator quit on me last week she said the job had too many demands this is Darknet Diaries