180: Conti

The word Conti struck fear in IT departments across the world. It's a type of ransomware that you hope to never come across. Like most ransomware gangs, the Conti group fell apart. But what's special about this story is how it fell apart. Because it fell apart in a very public, messy, scandalous way. Featuring investigative journalist Geoff White and cyber threat researcher Alex Holden. SponsorsThis show is brought to you by Doppel https://doppel.com/. Doppel stops AI attacks with digital risk protection, human risk management, and email security on a unified social engineering defense platform. doppel.com http://doppel.com/ This show is sponsored by Maze http://mazehq.com/darknet. Maze uses AI agents to triage and remediate cloud vulnerabilities by figuring out what’s actually exploitable, not just what’s theoretically risky. They remove the noise, prioritize vulns that matter, and manage remediation, so your team stops wasting time on meaningless vulns. Visit MazeHQ.com/darknet http://mazehq.com/darknet for more information. Support for this show comes from ThreatLocker https://threatlocker.com/Darknet. ThreatLocker is a Zero Trust Platform that gives organizations control over what can run and what users and devices can access. It combines prevention with real time detection and automated response, helping security teams stop unauthorized activity and quickly contain compromised machines. Learn how ThreatLocker can strengthen your defenses at threatlocker.com/Darknet https://threatlocker.com/Darknet. View all active sponsors. https://darknetdiaries.com/sponsors/ SourcesFull list of sources on the show page: https://darknetdiaries.com/episode/180/

• 0:00Speaker 00

  There's a kind of silence that follows a ransomware attack. Your throat gets dry, your chest gets a little heavy, and everything around you goes silent, especially when you see text like this flash across your screen. "All of your files are currently encrypted. If you try to ignore us, we've downloaded your data and are ready to publish it." You don't know who's on the other side of that ransomware note, or just how much damage they may cause if you don't pay up. The most fearsome enemy is the one you can't see. That silence, pulsating fear, can be deafening as it creeps across hospitals, trying to treat patients, or business owners trying to make payroll, or teachers running a class full of kids.

• 0:41Speaker 01

  "The time is almost over. We need your decision. If we don't receive any reply to this message, we begin publishing your data. Conti is here to prevent any further damages."

• 0:55Speaker 00

  For years, there was a group that called themselves Conti, and they wreaked havoc across the internet.

• 1:02Speaker 01

  "Conti is here to prevent any further damages."

• 1:06Speaker 00

  Hackers operate behind a curtain, known mostly by the destruction they leave behind. We rarely hear or see them. They want to remain covered up in the shadows, under the guise of codes and keystrokes. But what happens when that curtain gets yanked? And suddenly, their deepest, darkest secrets are exposed for the whole world to see. Not just their threats against us, but their arguments, their insecurities, and fears.

• 1:34Speaker 00

  These are true stories from the dark side of the internet.

• 1:41Speaker 00

  I'm Jack Reisider. This is Darknet Diaries.

• 2:03Speaker 00

  This episode is sponsored by ThreatLocker. The weird part about modern cyberattacks is how normal they look. The attacker logs in from Chrome, uses PowerShell, runs a remote admin tool your IT team already trusts. There's no custom malware, no dramatic movie hacker moment, just normal tools used in the wrong way. That's part of why ThreatLocker exists. ThreatLocker helps organizations control what software can run, what it can do, and how systems communicate. If attackers get credentials or land on a machine, they'll have a much harder time moving through the environment, because security teams are realizing something important. The problem isn't always unknown software anymore. Sometimes it's trusted software being used by the wrong person.

• 2:46Speaker 00

  If you want to see how ThreatLocker works, go to threatlocker.com/darknet and book a demo today. That's threatlocker.com/darknet to book a demo.

• 3:01Speaker 00

  This episode is sponsored by my friends over at Maze. GitHub saw nearly a billion commits last year. This year, with AI agents writing code, they're on pace for 14 billion. Code is shipping faster than ever, and its vulnerabilities are piling up just as quickly. Legacy SCA and SAST tools weren't built for this kind of scale. That's why Maze just launched Maze Code. They're using AI agents to investigate every vulnerability in your dependencies and in the code your team writes. The agents use context from your code and cloud to prove what's really exploitable in your environment, not just theoretically risky. Then they go further, catching the business logic flaws other tools miss.

• 3:45Speaker 00

  And when something's exploitable, they find the fix and send it straight to the right developer, or your coding agent. Check out Maze at mazehq.com/darknet. That's Maze, spelled M-A-Z-E. Mazehq.com/darknet.

• 4:05Speaker 00

  When I think about the lifespan of a Russian cybergang, there's an image that comes to mind. It's that Russian nesting doll. You know, those wooden dolls that stack together, they stack inside each other. They start small, and then they get bigger and bigger and bigger. Russian hackers kind of operate in the same way. One tiny group starts it, they're at the center. And then they develop more and more layers around them. They get bigger and more influential, and can rack up millions of dollars and leave a trail of destruction. These Russian cybercriminals seem to be untouchable by the Western authorities. The FBI and Europol can't go into Russia to arrest them. But they can issue arrest warrants for them in case they trip up or fly somewhere outside of Russia. They might get arrested. But you might think that when the cybercriminal gets arrested, it's all over, right?

• 4:50Speaker 00

  Well, not exactly. Like those nesting dolls, when a cybergang forms an outer shell, it forms into something else, sometimes something even more sinister. And it keeps happening over and over, until there's splintering cells, each one learning from the other, each one working together. And that's how I think about Conti, one of the most successful ransomware gangs in history. But before I get into Conti, let's back up a bit and take a look at where they came from. Before them were other ransomware groups. There was the Dire Gang, and there was Trickbot. And a central person in both of those was a Russian crime boss who went by the name Bentley. Bentley was an entrepreneur at heart, and found creative ways to launder his cybercrime profits.

• 5:33Speaker 00

  In order to securely access profits from cybercrime, this Bentley character created side hustles to launder his cybercrime profits. It's a hard problem that hackers have to figure out all the time. How do you turn ransomware payments, stolen credit card data, or crypto into something you can buy without leaving a paper trail? It's where the business of illegal hacking meets the real world. And Bentley's big idea was to use his proceeds from the Dire ransomware gang to create a film production company. I guess his idea was that if he can make a film with dirty money, and then that film makes actual money, then that money is clean.

• 6:11Speaker 02

  They were ending up with so much money that they needed some vehicle through which to wash the money.

• 6:15Speaker 00

  That's Jeff White. He's a good friend of the show. He's an investigative journalist out of London, and he's been reporting on some of the world's most prolific hackers, from the US to North Korea to Russia. And he hosts a new BBC podcast on Conti called The Conti Files. Jeff says Bentley's film production company was called The 25th Floor Film Company, housed in a skyscraper in Moscow. Now, this wasn't just an idea of Bentley's, they were making actual films.

• 6:41Speaker 02

  Obviously, they had to make some films, because if you have a front company, it's got to actually do some of the work that the front company is supposed to be doing. So they thought, well, what film shall we make?

• 6:50Speaker 00

  They worked on some movies and television shows in Russia and surrounding countries. And they also produced action films with A-list American stars. Like, there was this movie called Exposed, starring Keanu Reeves, which was made by them. Nobody's talking. And I don't blame them. He's dead, he's dead, she's dead, but somebody knows something. And Bentley knew all the ins and outs of the cybercrime underworld. And he had a film production company, and this made him start to think.

• 7:20Speaker 02

  And hilariously, they decided they would make a film about a group of Russian computer hackers, which was going to be called BotNet. And this film they were going to make, when I spoke to the screenwriter, a guy called David Kaplan, who was recruited in Hollywood, some Russian guys came up to him at a party and suggested he might like to write this film. And then when he starts researching it, he went over to Russia to meet the film company, not realizing that the very building the film company was based in was also the same building where the hackers were working on this malware. And they described the plot to him, and they sort of said, well, there's going to be this guy in charge, going to be sort of big, bald guy, and there's going to be this smart number-two guy, and then there's going to be a glamorous woman. And all of these people were actually real characters, real people, in the Dire Gang.

• 8:04Speaker 02

  You know, Bentley, the guy who went on to become Stern, who went on to run Conti, was going to be one of the characters in the film. And apparently, they had a plan that they were going to come across to Hollywood and actually shop this around and try and get some funding for it. So it's just, I can never get over this. In order to launder the profits from cybercrime, they created a film company, and then we're going to use the film company to make a film about the same cybercrime they were using to make the profits to launder through the film company. I mean, it's just, it's genius, in a way, evil genius.

• 8:33Speaker 00

  A critical rule in the hacker underground is don't dox yourself. It's really rule number one. If you're doing cybercrime, you've got to use fake names, fake addresses, burner emails, burner phones. You can't trust anyone you're working with, because if they know who you are and they get compromised, now suddenly, you're compromised too. The best operators in the world are the ones you've never heard of. Silence is their shield. People in this world, who can't resist telling their stories, are often the first to get caught. So it's wildly surprising that Bentley, and even the people around him in the Dire Gang, were thinking about making essentially a documentary about their ransomware gang.

• 9:13Speaker 00

  But in the end, Bentley never reached his dreams of making his big break with this movie, BotNet. Those dreams came crashing down at the end of 2015.

• 9:22Speaker 02

  Now, tragic end to the 25th Floor Film Company, and indeed, to the Dire Gang. They actually got raided by the Russian authorities. We don't know why. Clearly, they fell foul of the Russian authorities somehow. Off the back of that, out of the ashes of that, emerges a new group. Now, that group, initially called Trickbot, starts to morph as they use ransomware. And the ransomware strain that they use, because there's different types of ransomware, the ransomware strain they use was called Conti. So eventually, the Dire Gang becomes Trickbot, and eventually Trickbot's known as Conti. And from then on, they're just known as the Conti Gang, because they're using Conti ransomware to infect victims.

• 10:00Speaker 00

  And now you're starting to see these Russian nesting dolls stacking up, one on top of each other, layers upon layers in the group. And within all these variations of hacking gangs, leaders like Bentley learned how to recruit other members of this growing empire.

• 10:12Speaker 02

  It's astonishingly astute and driven and organized group of people. And as you say, recruiting was a key part of it. You know, they were able to recruit people through Russian sort of job seeker sites. They were obviously very cagey about what the operation was. They would say, do you want to join a, you know, fast-moving startup?

• 10:31Speaker 00

  And one of those early hires was a Latvian computer programmer, who went by the name Max. Now, when I first heard that there's a computer programmer in the Conti gang named Max, the first thought I had was, of course, there is. Max is a very popular, classic hacker handle. This guy's probably watched too many hacker movies, and he's probably wears hoodies and has his computer that's like got LEDs inside the case and stuff. But actually, this Max is opposite of what I pictured. Max is chatty, middle-aged, and a woman from Latvia, a mom even. Her actual name is Alavita. She spoke with a journalist, and the BBC translated her responses.

• 11:10Speaker 03

  A long time ago, I graduated from Latvian State University.

• 11:13Speaker 00

  Max grew up in the 1980s in Soviet Union and managed to pick up coding work in Russia. Max has a degree in applied mathematics and wanted more than anything to become a computer programmer. She got married, had kids, and moved all the way to the tiny country in South America.

• 11:29Speaker 03

  There, I continued to work with Russians, but it was all uncertain. From one project to the next, I wanted more stability and didn't want to work alone, just my client and I.

• 11:40Speaker 00

  So she's looking for a job. Computer programming is what she always wanted to do. And she comes across a talent boot camp for coders.

• 11:46Speaker 03

  I attended this free-day webinar. Your CV kind of goes into circulation, and the potential employer can come across it and even reach out with some kind of invitation.

• 11:57Speaker 00

  Max sends her resume, and someone responds to see if she wants to join their company. She didn't ask a lot of questions about who this company was, and she didn't get a lot of information because Max thought that's just how it goes in the land of coders. As part of the job application, she was asked to take a test.

• 12:11Speaker 03

  So I said that I would take this test. It was quite complicated, but I solved everything and sent them a link so they could see the results. And the week after, they write back to me, "Okay, you've passed the test. When can you start?" And I'm like, "If you want, write today."

• 12:27Speaker 00

  She gets the job and starts getting to know her coworkers. Everyone is remote. Now, remember, Max is living in South America, so it feels a bit isolating. There's some watercooler talk over Jabber Messenger, but something feels off. None of her coworkers are using their actual names. Instead, they're using strange nicknames like Professor, or Snow White, or Adelina. Simple, random nicknames. And then there was one other thing. No one on the team wanted to do a video chat with her.

• 12:58Speaker 03

  I asked if we wanted to Skype, but they said that they were just chatting. I like good jokes. That's why I wrote ironically in the mail. "Ah, maybe you're the kind of hackers you hear so much about." He answered me, "No, we are not hackers."

• 13:14Speaker 00

  But soon enough, she learns the truth. Her boss gives her a link to a page that had some wording on it. She's told to use what was on the site as a template for other sites, and that's all she knows. The page loads. She sees the gears turning, turning. Max stares at her screen. Scrolling text comes across it, and it starts to come into focus.

• 13:35Speaker 03

  There was text. "Your computer is infected, blah, blah, blah. So pay money."

• 13:41Speaker 00

  It's a template for a ransomware note. This was the first time Max realized she is not just a computer programmer for some tech company. She's a programmer for a cybercriminal enterprise, where at the center was Bentley, who had pieced it all together from the rubble of the 25th Floor Film Company. This is the moment where Max goes from being an innocent computer programmer to knowingly being part of an international cybercrime syndicate, which has to be some decision, right? Like, when you realize you're infecting the world with ransomware, do you say, "Oh, no, that's against my ethics"? Or do you just shrug your shoulders and say, "You know what? It's good pay. Why not?"

• 14:21Speaker 02

  At that point, she decides to stick with it. And actually, at that point, she's living very far away from home. She was living actually in Suriname in South America. I think she felt like she was very far away from any risks maybe there. She felt she was just working. By this point, she realized she's working for a ransomware gang. But I think she felt quite insulated and also felt that her role was fairly junior within this. It's a classic thing where I think she justified it to herself of, well, you know, "I'm not really doing any hacking. I'm just doing some coding for them."

• 14:52Speaker 00

  Over the years, Max became a bigger and bigger part of the ransomware operations. While her focus is web design and web development, investigators said because of her language skills, she was able to help write ransomware notes.

• 15:04Speaker 02

  Now, Max wasn't massively graded operational security because she ends up hosting some of the Conti ransomware code, apparently, on her own website in her own name. Alavita is her name. And had also done some YouTube videos at the time, so was also identifiable from those. It could be that her security was rubbish, or it could be that she just didn't realize how at risk she was.

• 15:29Speaker 00

  This was the early stages of the Conti ransomware group forming. And they had already began infecting systems and getting paid when somebody wanted the decryption key, which, of course, was starting to draw attention of the US authorities. They began investigating who was behind Conti, which led them to Max. And soon they discovered her real name was Alavita. And they found that she was living in South America. They found out that she actually overstayed her visa while in South America. And so the US authorities worked with the local authorities there to find her and get them to fly her home to Russia because she overstayed her visa. But they purposely put her on a flight to Miami to make her connection to Russia.

• 16:10Speaker 00

  And when she landed in Miami, she was arrested by US authorities. This was the first person to go down in the Conti group. They were charging her with her involvement with Trickbot and Conti. At this point, Trickbot was working closely with the Conti ransomware gang. And soon they would merge together. Conti was going to acquire Trickbot. And Conti ransomware was becoming sort of a service where you could be an affiliate of theirs. You could use the Conti ransomware to infect a network somewhere. And then, once infected, the Conti team would then take it from there, negotiating payments, handing over decryption keys, et cetera. And then the affiliate would get a cut of it. A few months after Max's arrest, hackers using the Conti ransomware launched a devastating attack

• 16:53Speaker 00

  that put Conti on the map of the world stage.

• 17:01Speaker 00

  In the early days of the pandemic, someone burrowed their way deep into Ireland's hospital network. The initial intrusion happened when a hospital employee opened a phishing email containing a malicious Microsoft Excel attachment. They clicked it. They opened it. They got infected. That was Patient Zero. Attackers got in and opened up a back door so they could stay in, and then they began making that infection spread. Dozens of infected machines became hundreds. One infected hospital became two, which quickly spread to 10. Thousands of machines were infected, and the infection kept spreading across clinics and offices and more hospitals.

• 17:45Speaker 00

  Thousands of machines were hit with this ransomware. In total, over 70,000 computers were infected at 4,000 locations. And over 40 hospitals were infected within the Ireland's hospital network. And it just sat there, quiet, waiting for the right moment to lock up all the computers.

• 18:11Speaker 02

  I sometimes liken it to being a burglar, you know? You break into a house. It's dark. You've no idea the layout of the house. And so you just have to kind of keep opening doors. And you hope that the door you open isn't the one into the bedroom where, you know, the people who own the house are there with a gun. There is a long process of scoping it out. And of course, at any moment, you might get caught. You know, your access might be revealed.

• 18:34Speaker 00

  And after weeks of lurking in the network's shadows, the hackers struck.

• 18:38Speaker 04

  Ireland's Health Service describing this as a significant ransomware attack. People asking how an attack like this could have happened in the first place.

• 18:46Speaker 05

  There's no doubt it is a vicious and a callous act, and will be condemned everywhere by decent people.

• 18:52Speaker 00

  It was total pandemonium. Ireland's healthcare system was hit with the most devastating ransomware attack they had ever seen by a Russian-based cybercrime gang called Conti. Every hospital in the Irish network felt Conti's attack. To keep track of patient appointments and records, clinicians just had to use pen and paper like the old days. The attack disrupted COVID and blood work tests. All this as Ireland was in its third wave of the COVID pandemic, its longest lockdown yet.

• 19:25Speaker 02

  This is the middle of a pandemic, and as you say, people in Ireland, they speak their minds, the Irish, and they absolutely hated this. Why would people attack our health service, and particularly during the middle of a pandemic?

• 19:35Speaker 00

  Maternity wards and pediatric units were thrown into chaos.

• 19:39Speaker 02

  This is basically an entire country's hospital system being held to ransom in one go. Absolutely stunning.

• 19:44Speaker 00

  It was unlike anything that they, well, actually, we've ever seen before. The information systems behind all these hospitals went into a tailspin, a total scramble.

• 19:53Speaker 02

  Health services, classically, do not prioritize IT security because they've got lots of other things to prioritize. And they generally don't think that they're going to be a target for hackers. They haven't been historically.

• 20:05Speaker 00

  And those patients ended up paying a big price. One person who Jeff actually talked to, who lived in Dublin, went through a particularly awful cancer treatment, a brain cancer treatment. But when the cyberattack happened, she was getting ready for a highly targeted cancer treatment involving lasers zapping the cancer in these precise spots. But with computers down, the doctors had to cancel her appointment. So she had to wait even longer to get her cancer irradiated. Stories like these began to flood through Ireland's hospitals. It was pure chaos. And of course, the Conti group was messaging the hospital, saying, "There's one thing that can make this stop: money." Just about every hospital in the network got a ransomware note saying,

• 20:47Speaker 00

  "We have ransomwared your data. If you want to contact us and negotiate, here is the way you do it." The hackers demanded $20 million to bring back up the hospital's computers. To make matters worse, the Conti gang said they had stolen over 700 gigabytes of data, like patient and payroll records. They were saying, "If you want us to delete it, you have to pay." Now imagine, you're the one in the Ireland Health Department that has to make the call on what to do next. You came into work, and you found every screen in the building displaying the same ransomware message. Everyone's files are encrypted. All the computers are down. Your backups are gone.

• 21:28Speaker 00

  People's lives are literally on the line, and at the bottom, a countdown and a price. Ireland's response?

• 21:36Speaker 02

  "No, we are not going to pay a ransom. Forget it."

• 21:40Speaker 00

  The executives for the Irish Health Service kept in contact with the Conti gang though. I think they were negotiating the price down. But I also think they were just trying to buy some time so that they don't publish the data yet. There was some back and forth between the two of them, while the Ireland health system tried desperately to get their systems back up and running all on their own.

• 21:59Speaker 02

  They're desperate to work out, how can we decrypt this data without paying the ransom? How can we get hospitals back on their feet? Which are the most important hospitals, you know? And you're going to make some hard decisions there, Jack. Right, you know, is children's health more important than older person's health? Do you prioritize cancer or do you prioritize some other diseases? You know, it's, it's, these are the kind of decisions they're having to make. They're literally life or death decisions about where you try and apply the help first. There was a calculation apparently made at the rate they were able to decrypt the data, how long it would have taken to decrypt all of it without the ransomware key, the decryption key. And it was in, it was in the years, like one or two years to unscramble it all. So you're facing these problems month after month, potentially year after year. So the hackers kept going.

• 22:42Speaker 02

  And of course, at this point, you know, frankly, you may as well, you scramble all the data. You're kind of in for penny, in for pound, or in for several tens of millions in this case.

• 22:53Speaker 02

  There was a period of several weeks where all of this was going on. The data was scrambled, hospitals really struggling. The hospitals were getting by, you know, the, the health professionals, they can, they can get back some test results, but it's a fraction of what they get. And they can continue treatment with some people.

• 23:09Speaker 00

  But after weeks, the hacker had a surprising change of heart. Out of nowhere, without having paid the ransom, they gave the decryption key over to Ireland and seemingly just left the hospital alone after that. It's still a mystery as to why, but there are some running theories. One theory is that there's a Russian embassy in Ireland and it condemned the attack, even agreeing to support Ireland as it recovered. So the hackers handed over the decryption key so hospitals could recover, but their attacks continued against other places in Ireland. They infected school districts, city government and businesses. Their demands were always the same. Pay up to decrypt your computers or else we release your data on the dark web.

• 23:51Speaker 01

  Just in case if you try to ignore us, we've downloaded your data and are ready to publish it if you do not respond. So it'll be better for both sites if you contact us as soon as possible.

• 24:03Speaker 00

  One of their targets in 2021 was this jewelry company called Graph.

• 24:10Speaker 00

  It's in the UK and known as the jeweler of the stars. Its clients include Donald Trump, Oprah Winfrey and David Beckham. But the client list is never revealed publicly by Graph. It's actually super secret. They are extremely tight lipped about who their clients are. But in 2021, Conti broke into the jewelry store digitally and stole a list of all of Graph's clients. This, of course, made Graph panic and they were extremely upset. The names and phone numbers of all their high-end customers has been stolen and in the hands of some cyber criminals? Forget about the computers being encrypted, the stolen data was more of a problem now. Conti wasn't messing around. When Graph didn't pay right away, they wanted to show them they were serious.

• 24:55Speaker 00

  So they took a chunk of this customer data and released it. 70,000 Graph documents hit the dark web.

• 25:02Speaker 02

  The solution to ransomware was pretty easy. Back up your data because if it's scrambled, you can swipe the computer, reinstall the data from backup and jog on and not pay the ransom. Of course, the ransomware gangs saw that, saw it's a threat to their business, which it was, and invented the idea of what they call double dip ransomware.

• 25:21Speaker 00

  Double dip ransomware, essentially a cyber attack with two steps. Steal sensitive corporate data before encrypting it. It gives the hackers more leverage. Conti demanded the jeweler pay tens of millions of dollars to decrypt its systems and to prevent more information from getting out on the dark web.

• 25:38Speaker 02

  So instead of just scrambling the data, we will steal a chunk of the data and then scramble the data. And if the victim refuses to pay because they've got backups to their data, we can say, ha ha. If you don't pay, we will leak this sensitive data. It's exactly what happened to Graph. So with Conti, it, it wasn't the full leak. It would have been, you know, a few hundred pages maybe of data. But in there would have been the data of very high profile clients. And my guess is that Conti scanned the information and thought, oh, look, there's some famous people here. We'll stick this online as a sort of threat to the Graph group and say, look, if you don't pay the ransom, there's going to be more of this. But Conti didn't look really carefully through the data they were leaking.

• 26:21Speaker 00

  It was actually too much data for the Conti gang to analyze effectively. In the end, Graph did pay up. They paid seven and a half million dollars in Bitcoin. They didn't want the rest of their client list getting out and they felt like this was the price they have to pay to keep their customers' records secret. But how much can you even trust this Conti group to be good on their word when they say they'll actually delete it? Ah, it must have been so maddening for Graph. But Conti's successful jewelry heist may have been rushed, even sloppy. We all make mistakes when we're rushing and Conti is no different. Within the initial breach of customer data leaked on the dark web, Conti unwittingly shared details of purchases of high profile members of society.

• 27:06Speaker 00

  And one of those was the Saudi royal family. That's right. Conti doxed the Saudi royal family.

• 27:17Speaker 02

  And that did not go down well, it seems, among the Saudi royal family. There, there are people around the world who you want to offend and people who you really, really don't. And the Saudis are probably very much in that category.

• 27:29Speaker 00

  After the UK's Daily Mail reported on this heist, the Conti gang must have been contacted by someone or threatened or something serious happened because Conti published an apology, something you never see from cyber criminals.

• 27:42Speaker 01

  We found that our sample data was not properly reviewed before being uploaded to the blog. Conti guarantees that any information pertaining to the members of Saudi Arabia, UAE and Qatar families will be deleted without any exposure and review. Our team apologizes to His Royal Highness, Prince Mohammed bin Salman and any other members of the royal family whose names were mentioned in the publication for any inconvenience.

• 28:10Speaker 00

  Conti said it removed the documents from Graph that had initially leaked online and claimed none of the stolen data was sold on auctions or offered as samples or revealed in any other capacity to any third party.

• 28:21Speaker 01

  Conti guarantees to implement a more rigid data review process for any future operations.

• 28:28Speaker 00

  Wow, that's really unusual that they retracted their, their leak. I, my head starts to go to, okay, somebody was influenced, somebody had enough wealth and influence to be able to say, okay, let's find out who these people were and go and personally threaten them.

• 28:44Speaker 02

  Yes, yes, there was an expert we interviewed for the podcast, intelligence expert. His assessment of this was that the kinds of wealth you're talking about and the kinds of people involved in those leaks, you're talking about the top strata of the world's richest, most powerful people. They have a cadre of people around them who look after their security and look after their interests.

• 29:10Speaker 02

  Those people are very good at their jobs and will make it absolutely clear to a gang like Conti. You have done this, there are going to be consequences for you. We have ways of finding you and if we find you, you're in a lot of trouble and potentially a lot of danger. So there would have been an intimidation of Conti to say, take this data down or else. You're not playing here with low players, you're playing with serious people. Now, as I say, we do not know, we're not privy to those emails because they would have been sent and received by, you know, the security teams behind these powerful people. But as I say, the proof of the pudding is in the eating. We know that Conti issued an apology and we know within this sort of internal conversations within Conti

• 29:53Speaker 02

  that they absolutely freaked out when this happened and were very worried. In fact, one of the quotes in the Conti gang was, they'll find you and you're gone. So we know that Conti worried internally. We know that publicly they were apologizing. If you join the dots, it does really look like somebody got to Conti and said, take it down or else.

• 30:15Speaker 00

  Wow, that's really surprising to me. I, I imagine these ransomware groups to be always getting threats from people, right? It's just like, I will find you and I will take your children or dog or something. And they just like watching the world burn. So it's just a surprise to see them be threatened in such a way, be scared in some way, that they issue an apology and redact their leak. They must have been really spooked. And they were on such a roll too. In 2021 alone, they collected over 180 million dollars from their ransomware operations. But I guess Conti was getting their first taste of flying too close to the sun. We're going to take a quick ad break here, but stay with us because when we come back, these nesting dolls are going to come apart in the most dramatic way possible.

• 31:06Speaker 00

  This episode is sponsored by Doppel. Protecting yourself from attackers used to be as simple as deleting dodgy-looking emails. But with AI, the attack surface has outgrown the defense that legacy vendors provide. Doppel was founded in 2022 to give companies back control. Doppel is an AI-native, social engineering defense platform. Doppel strengthens human risk management by training employees to recognize deception and provides digital risk protection across every channel. It even delivers agentic email security that doesn't just score the inbox, but takes down the attacker infrastructure behind the message. Those dodgy-looking emails have been replaced by bespoke and personalized texts, URLs, ads, and even social media connections.

• 31:49Speaker 00

  But Doppel can then turn these attacks your business receives to inform campaigns and security awareness training for your employees so that they know what to look out for. Doppel: Outpacing what's next in social engineering. Learn more at Doppel.com. That's spelled D-O-P-P-E-L. Doppel.com.

• 32:13Speaker 00

  Imagine this: Two Russian hackers are having a conversation. One of them is planning a major attack against, I don't know, a hospital, let's say. And the other is in disguise, posing as a Russian hacker, and he's really trying to thwart that attack. The conversations are happening over a dark web forum, or on Jaber, or Rocket Chat. And sure, conversations with a Russian hacker might start lights, like talking about fishing, or visiting St. Petersburg's art museums. But then, they'll take a turn, shifting to actual criminal secrets. Just imagine, if you could get a hacker to be vulnerable when their guard is down, what kind of intel could you get about targets or methodologies for attack?

• 32:56Speaker 00

  Could you turn them away from cybercrime?

• 32:59Speaker 06

  We find fascinating things on the dark web. We engage with the bad guys. We get inside of, not only their systems, but inside their heads.

• 33:07Speaker 00

  This is Alex Holden. He's a Ukrainian cybersecurity researcher, now living in the US. And he runs a company called Hold Security, based in Milwaukee. Years ago, him and his team of analysts began infiltrating members of Trickbot, which would go on to get acquired by Conti. Alex and his team talked with Trickbot members, pretending to be black hat hackers, trying to gain their trust. They weren't buying or selling anything, because that is illegal. But they were on a top-secret mission to make connections. And that's what Alex does with ransomware gangs, nation-state threat actors, or hacktivist movements.

• 33:41Speaker 06

  You would be surprised, but the bad guys on the dark web, a lot of them need to talk to somebody, they need a friend. And we create this friend environment for them to start spilling their deepest and darkest secrets.

• 33:55Speaker 00

  So they're getting some of Trickbot's deepest and darkest secrets through its members. They even applied for jobs at Trickbot and tried to move up the chain. And they developed relationships with the members to learn more, and maybe even turned them good.

• 34:07Speaker 06

  And we also meddled with some of their perceptions, opinions, even building paranoia for some of them, saying that law enforcement is coming for you.

• 34:18Speaker 00

  And after a while of chumming it up with Trickbot, Alex caught a big break.

• 34:22Speaker 06

  So one guy, part of Trickbot, decided to give his girlfriend, as a present, access to Trickbot. So this is not a, like, top presents that guys give to their girlfriends, but he gave access so she can go shopping. So he showed how to find credit cards, how to take virtual machines, and stuff like that. And threw a polio virus, because we had visibility into her communications, and she did not believe in encryption or good passwords or anything like that. She basically disclosed all of it. So that was one of the main advantage points for a while. But over time, we start looking at this and say, okay, here's access to a Jaber server.

• 35:03Speaker 06

  Because this girl was given an account, and the password was 123456. And that's what the admin gave her. But his password just had letter A and an after 123456.

• 35:20Speaker 00

  Alex's team whittled their way into Trickbot's infrastructure, scraping chat logs and eventually cloning the network, and while continuing to make connections with some of the big players in the Trickbot echelon.

• 35:30Speaker 06

  You'll build friendship with some of the people, including with Stern.

• 35:35Speaker 00

  Ah, yes, Stern. Remember I told you about that guy Bentley before? He was the one who ran the Dire ransomware gang. And then he started the 25th Floor Film Company. And then he started the Trickbot ransomware gang, which morphed into the Conti ransomware gang. Well, when it morphed into Conti, he morphed from Bentley to Stern. But at the time, we didn't know who this Stern guy was. We only knew that he was one of the nesting dolls at the center of Conti.

• 36:02Speaker 06

  At some point, Stern wants to build his own crypto mining platform. And there is conversation, like, 30, 40 pages of conversation about that. But this is like, you know, the idea to sway it from cybercrime to social angle.

• 36:21Speaker 00

  Trying to limit Stern's damage. There are a lot of moving parts here. A lot of sleepless nights where Alex and his team was glued to chat logs, reading chat forums. They watched Trickbot, starting in 2019, and continued as Trickbot got acquired by Conti two years later. His team obtained hundreds of thousands of messages. They curated the data, they read through it, and published summaries of the data. And what they saw was a criminal enterprise, a lot more organized than any of them even imagined.

• 36:52Speaker 06

  Trickbot was run by Stern as a company. It was not run as a gang. And, you know, I'm very used to corporate America. It doesn't look like that right now. But the company that they run, they had different departments. They had physical offices. They had lunches, they talked to each other. They were sympathetic to employees, like Alavita, who got in trouble.

• 37:19Speaker 00

  Alavita is the Trickbot member I told you about earlier, who was arrested. She went by Max, remember?

• 37:25Speaker 06

  They even said that they are allocating $25 billion in the first eight months of 2021, I believe, to improve their infrastructure. Not every company can afford that much of expansion. They did. So it was budgeting, it was, you know, accounting, it was everything.

• 37:48Speaker 00

  Alex's team also got insight into attacks that were still in the planning stages, attacks against schools, city governments, and hospitals. Here's one Conti member, named Target, writing about going after healthcare.

• 38:01Speaker 01

  We got on a video call with them. They offered 18 Bitcoin. Their turnover is 30 million. Let them pay millions. Tomorrow, we'll make a move that'll make the whole leadership go, "Please, miss, don't do it." They got used to little old chats and messages over there. 18 Bitcoin. Tomorrow, the whole office will rob them. Let them die.

• 38:28Speaker 00

  Despite this being criminal activity, there are still certain rules that criminal hackers have. Ask enough people in the ransomware underground, and you'll hear that there are certain targets that are just off limits, like hospitals. After the Russian hacking group, Lockbit, targeted a children's hospital in Canada in 2023, it publicly apologized and turned over the decryption key. It didn't know it was a hospital. In the Conti chat logs, you can see internal disagreements about the ethics of going after healthcare. For example, one Conti member asks the Conti boss, Stern, if he signed off on encrypting the hospital's data. And Stern responds with:

• 39:05Speaker 07

  I usually don't approve encryptions. If you didn't approve it, I will hand the decryptor to that clinic. We agreed not to touch the medical sector, remember?

• 39:14Speaker 00

  This Conti member, who's pushing back against going after hospitals, messages Stern, complaining about their coworker, someone who goes by the name Dollar.

• 39:22Speaker 07

  Let's get Dollar out of the game. He's a total idiot. Back then, he screwed me over, claiming he had an agreement with you to mess with the hospital. And now, he targeted the hospital again. That's disrespectful. I told him twice that we don't touch the medical sector.

• 39:39Speaker 00

  At this point, Conti's members and affiliates were in the hundreds. And as it grew, it became more challenging to control hacking operations. So it's no surprise you'd get these internal refs about who to attack. And to make matters worse, Conti was without leadership. The boss, Stern, drifted away from the chat logs. He was just not present very much anymore. My theory is that when you start a new and upcoming cybercrime group, it's exciting. It's fun. But then, when things start turning into just handling customer support issues all day long, leaders often lose interest. One of his deputies, someone who went by the name Mingo, got growingly frustrated about this.

• 40:18Speaker 08

  You constantly give me the impression that you don't care. You need to be online more often and, in some situations, be a bit tougher for disciplinary purposes.

• 40:28Speaker 00

  And then by January 2022, researcher Alex Holden says Stern left Conti without a trace. The chat logs just show Conti falling into chaos after that.

• 40:38Speaker 01

  Listen, Stern has gone missing. No, he's not missing. He'll show up soon. Everyone's looking for him.

• 40:45Speaker 00

  With the boss gone, people started getting worried if anyone was going to get paid. Members weren't quite panicking yet, but it felt like the ground was becoming unstable within Conti. And then, to everyone's surprise, a full-blown war erupted.

• 41:04Speaker 09

  It was unprovoked, but this is what Russian President Vladimir Putin unleashed on Ukraine. As the sun came up this morning, a missile striking an industrial park in western Ukraine. A helicopter assault on an airport outside of Kiev. Close, intense fighting, and there are civilian casualties.

• 41:28Speaker 00

  And little did we know that Russia invading Ukraine was going to send a shockwave through Conti. Many of the members were glued to the news.

• 41:36Speaker 10

  I hope that Kiev will be ours by evening.

• 41:39Speaker 00

  But not everyone in Conti was rooting for Russia. Many of Conti members were from Ukraine. The war split a lot of families because some families were living in both Ukraine and Russia, and suddenly they were at war with each other. The war completely split the Conti pack, with some of its operators really unhappy about this invasion.

• 41:58Speaker 07

  Friends, brothers, are there any Ukrainians besides me? Madness. Support me, brothers.

• 42:06Speaker 00

  I mean, I'm just thinking about, how can you be thick as thieves with someone and go rob the world of millions of dollars doing cybercrime together? And then suddenly go to war with the very people in your own group? Members were torn about what to do.

• 42:22Speaker 11

  Talking to you directly, your posts are painful for the members of our team.

• 42:27Speaker 00

  Emotions and tensions started flaring up in the group chats. Half the Conti gang were saying, "Kiev by dawn", and the other half were saying, "Slava Ukraina". And eventually, Conti, as an organization, took a stand, releasing a statement for the world to see.

• 42:42Speaker 01

  The Conti team is officially announcing full support of the Russian government. If anybody decides to organize a cyberattack or any war activities against Russia, we are going to use all our possible resources to strike back at the critical infrastructures of an enemy.

• 43:00Speaker 00

  When that message showed up on computer screens across the world, there was someone who took this note very seriously. He was an IT specialist from Ukraine, and this message consumed him with anger.

• 43:14Speaker 12

  I cannot shoot anything, but I can fight with a keyboard and mouse.

• 43:19Speaker 00

  In an interview at the time, he told CNN he was prepared to cut deep into Conti where it hurt. We had someone voice his responses.

• 43:27Speaker 12

  It's my country. If the Ukrainian government provides me weapons, okay, I'll go fight, but I'm better at typing.

• 43:38Speaker 00

  This Ukrainian IT specialist had a plan. He wanted to do a data breach on the Conti ransomware gang itself. He thought if he could get into their internal communications, download all their chat logs, see what their network consists of, look at their member information, he could expose them in a very devastating way. He started working with Alex Holden and others to try to obtain the Conti chat logs. He was grabbing the chat logs while other members of the team were reading through them and providing summaries. These messages were private in the Conti network. They were never meant to be released. But he was determined to expose them, to ruin Conti. He came to Alex and told him what his plan was.

• 44:19Speaker 06

  He talked to me ahead of time. We talked about how to do this properly, and it turned out the way it did. I had no control over it. I did tell him that he needs to think about it, but from a legal perspective, it was not our data. And from a moral perspective, I'm also from Ukraine, and I completely understand him and his actions. You have to understand that in the first days of the Russian invasion into Ukraine,

• 45:00Speaker 06

  Conti stated that they fully support the cause of Putin. And my friend, as a Ukrainian citizen, Ukrainian national, felt that this is his way not to pick up a weapon and defend his homeland, but something to do bigger against the aggression from Russians.

• 45:33Speaker 00

  Then, about a week after the invasion, the Ukrainian analyst had infiltrated Conti deep enough and gathered enough incriminating data that he thought it was time to start leaking the data. He created a Twitter account called @ContiLeaks, which it's very ironic to breach and expose a company who's in the very business of breaching and exposing companies, right? Here's what the first tweet said.

• 45:55Speaker 12

  Greetings. Here is a friendly heads-up that the Conti gang has just lost all their shit. Please know, this is true.

• 46:03Speaker 00

  Now, there's been speculation from researchers and journalists that the leaker may have been a disgruntled former Conti member. The truth is, we aren't exactly sure who the leaker is, but Alex Holden says he knows. He says the Conti leaker is a computer specialist who, at the time of the leaks, was a consultant for his company and continues to live in Ukraine today. Regardless of who he is, he released the Holy Grail for cybersecurity analysts, researchers, and journalists who were studying this gang.

• 46:32Speaker 12

  The contents of the first dump contain the chat communications, current as of today and going to the past, of the Conti ransomware gang. We promise it is very interesting. There are more dumps coming. Stay tuned. Thank you for your support. Glory to Ukraine.

• 46:53Speaker 00

  Over several data dumps, there were tens of thousands of internal messages released. There were conversations about planning attacks, names of members, pictures of members, and details about the organization structure of Conti, which was surprisingly hiding in plain sight. But there were also nuggets that were meant to strike deep into Conti where it hurt, like the cryptocurrency accounts used to steal millions of dollars in ransomware payments, or discussions about going after journalists reporting on the poisoning of the Russian opposition leader, Alexei Navalny. Alex Holden says before the logs were released, there was information excluded for safety reasons, but he says nothing was altered.

• 47:32Speaker 06

  My goal in cyberthreatening intelligence is to help victims and help victims as effectively as possible. So, you know, he did what he did, and he changed the world. We change the world one victim at a time. He did something bigger.

• 47:50Speaker 00

  Because in this situation, Conti was a victim of a database. So this whole thing is like flipped on its ear. I don't think we've ever seen a data breach like this before, where the hackers got hacked.

• 48:02Speaker 06

  I don't think it was the right thing to do. The Conti shattered in many different groups, and the members became part of many other ransomware groups that start multiplying the crime. And losing visibility actually increased the number of victims.

• 48:23Speaker 00

  Alex Holden says even though he wouldn't have publicly released the logs, the disclosure changed the Conti gang in profound ways.

• 48:30Speaker 06

  How many trick bot and Conti operatives been unmasked since? How many of them were indicted? How many of them are on wanted lists for us from law enforcement perspective?

• 48:46Speaker 00

  I remember when these leaks came out. It was quite a moment if you were on Twitter at the time. We all got our popcorn out and was just watching this cyber gang unravel in real time. The nesting dolls just kept opening one after another. And we had no idea how many would just keep opening. It was just wild to see one open after another. People were being exposed left and right. There were pictures of the Conti gang going around. Soon there were memes about the members. Like surprisingly, there was a half dozen women who were members of the Conti gang. And so you'd see posts like, "These are the women of the Conti ransomware gang." And lots of photos were shown of just them, driving in cars, eating lunches, passports, photos of them. Many of them were looking like they were part of the world of luxury.

• 49:28Speaker 00

  It felt like the lid of this shadowy, dark underworld just blew off in an instant. It was such a rare glimpse into one of the most successful ransomware groups of all time. Twitter was having a field day. This wasn't your typical white paper right up on some ransomware group. This had drama, this had intrigue, this had dirt and scandals. And I even posted a meme which said, "Infosec, we know drama." Just reading through the chat logs, you see all kinds of infighting. You can tell that something catastrophic is going to happen soon. A lot of us were just sitting back in our chairs like, "Wow, season one of this show is amazing." Investigative reporter Jeff White grabbed a front row seat.

• 50:08Speaker 02

  When this came out, I think there was all this stuff about cyber attacks around Ukraine, trying to keep abreast of all of that. Then these Conti leaks come out. It's 70,000 messages, Jack. It was an absolute nightmare. They're all in Russian, they're in Cyrillic characters, they're in hacker slang, so you've got to try and start translating them. And then immediately afterwards, you get this second huge dump of information, it's even more messages.

• 50:33Speaker 00

  You read 47,000 of these messages?

• 50:35Speaker 02

  Yes, yes, yeah, I did.

• 50:37Speaker 00

  Amazing.

• 50:37Speaker 02

  The thing about the leaks is it's thousands of messages, they're all in Russian, they're all in Cyrillic characters. And obviously you're thinking, a lot of your listeners will be thinking, "Well, stick them in one of these LLMs, you know, let the AI do the work." LLMs do not deal well with Cyrillic alphabet, so there's loads of mistranslations. So one of the things they keep talking about in the leaks is the Qballs. Who's got the Qballs? Like Snuka or Pool or, you know. And I couldn't understand this, and then I realized that if you take the Russian translation of Bitcoin, Bitcoin, but the N at the end, because it's in Cyrillic, looks a bit like a V, so the translation engine translates as Bitkov, which in Russian is Qball, Bitkov Qball. And so whenever they're talking about the Qballs, it means they're talking about Bitcoins.

• 51:20Speaker 02

  So immediately you start to kind of understand there's a code almost in the translations. The other thing they kept talking about was the Toad, as in like the reptile, like, "Why is the Toad slow?" And "I've got problems with the Toad." And I couldn't understand why they kept talking about the Toad. And it turns out this was the software they were using to communicate was Jabba, which in Russian is Haber, and Haber translates as Toad. So they keep talking about the Toad and you realize they're talking about the Jabba thing being slow. As you're reading through these messages, you have to go through them by eye, I think, one by one, because only then you get the hang of what is actually being discussed.

• 52:01Speaker 00

  Okay, so after, you know, the leaks came out and we start to see the inner workings of how this Conti ransomware gang is operating, do they skitter? Do they run away? Do they hide, shut up shop? Or what happens to them?

• 52:14Speaker 02

  So in terms of what happened next to Conti, we know that the gang apparently disbanded. And we know that there was talk in the chats of, "Well, you know, it's coming to an end, just go off and, you know, rest for a little while, we'll regroup." People who track these things are pretty sure that various affiliates from Conti just became affiliates for other gangs. There's some suggestion that Conti members set up other ransomware groups, there's crossovers with Code and so on. So the thing splinters and it fractures. But there's this amazing moment where they decide, someone, somewhere within Conti decides they're going to go for one last big takedown, and they're just going to do an absolute showstopper. And that's when they decide they're going to hit an entire country, they're going to

• 52:58Speaker 02

  hit the government of Costa Rica.

• 53:00Speaker 00

  Late today, we learned that Costa Rica has declared a state of emergency after a ransomware attack. Sounds very serious.

• 53:13Speaker 13

  That was very terrifying for us. Over thirty government organizations were compromised by that campaign. Like, we didn't know what to do. Exposed citizens' personal information, so it's not clear how they're going to resolve all this.

• 53:29Speaker 00

  Yeah, Costa Rica declared they're at war with Conti. How about that? Nobody was expecting this as the next step from Conti, especially after they just got exposed. About two dozen different government organizations were targeted, and many sectors came to a screeching halt. This was a big deal for Costa Rica. The first thing that was hit was Costa Rica's treasury. One of the big ramifications of that was importing and exporting of goods. And all that's run digitally, so that just collapsed. And they had to go back to pen and paper. But Costa Rica was not ready for that. A large chunk of the country's money just got cut off because imports, exports just grinded to a halt. There were also disruptions with paying salaries and pensions for government workers.

• 54:09Speaker 02

  In the end, the sort of solution they came up with was, anybody who got a pension last month gets another pension this month, you know, just pay people again and hope we sort it out later. So they did manage to get around that.

• 54:19Speaker 00

  There was also political consequences. This attack happened right in between a change of presidential administrations, and it fed into the whole campaign against the existing government, like, of course they're incompetent, they couldn't stop this cyber attack.

• 54:30Speaker 02

  It sort of fed into this sense of, you know, a country that was kind of on the edge. As the government started looking at this and refused to pay Conti, Conti upped the ante and attacked more parts of the government, more government departments. I think the Science and Technology Department got attacked. And in the end, there was various local government websites that got taken down. As I said, you've got this pylon effect where other gangs and other cyber criminals started to get involved. And the Conti government was in the end fighting fires. I mean, they were probably in the dozens of attacks, some much bigger, you know, like the treasury and so on, some much smaller in terms of local government institutions. But it really was pandemonium and happened at this time of a transfer in government when Costa Rica was particularly vulnerable.

• 55:15Speaker 00

  The incoming president treated this like it was a national emergency. And like a wildfire, the vulnerabilities spread across government organizations. Some systems were infected through phishing emails, while for others malware was just put right on them right from the internets. And something became clear. Maybe this wasn't just Conti.

• 55:34Speaker 02

  As the attack went on, other cybercrime groups, other ransomware groups emerged and also started attacking Costa Rica. So it was kind of a pylon. So Conti were there, definitely, but the effects of the Conti gang got amplified as the attack unfolded over weeks in Costa Rica.

• 55:51Speaker 00

  Yeah, I don't know if it matters or not, but we don't know if it was the Conti ransomware gang that actually picked their targets, or if it was their affiliates that picked the targets, or a mix of both.

• 56:01Speaker 02

  Precisely. I mean, you know, Conti had so many affiliates by this point, and those affiliates would of course all have had access to the encryption software, the ransomware software. And so even if the central core Conti group dissolved, it strikes me as possible, certainly technically, that somebody could have retained that encryption software. And if they're an affiliate and are good at getting it into a network and infecting a network, there's no reason why they couldn't have used the Conti sort of ransomware without the core Conti gang being aware of it, approving it, or even still being in existence. This could have been an entirely single affiliate-led job. I think, from my technical understanding, that's certainly possible.

• 56:42Speaker 00

  Another possibility, Jeff says that this was a former member of Conti that was just flexing their muscles, saying, "Hey, I came from Conti and I did the Costa Rica attack. Imagine what else I can do." And we know for sure that Costa Rica got hit by Conti ransomware, but that was the last incident we ever saw of the Conti ransomware. Because after that, arrests started happening. Certain low-level members of Conti and Trickbot were getting nabbed. Conti seemed to be done. Too much had been exposed. The war tore the members apart, and Stern, their leader, was still missing from daily operations. But the affiliates that were helping spread the Conti ransomware, many of them probably just joined other groups.

• 57:26Speaker 02

  There were loads of other gangs recruiting. If you say, "Look, I was with the Conti gang, I managed to get a couple of high-profile targets, you know, can I work with your ransomware as an affiliate?" You're likely to get a job elsewhere. In terms of the core Conti gang, we don't know what happened with them. The suspicion is they went on and formed other groups.

• 57:46Speaker 00

  The fact is, many of the Conti members who appeared in the logs, we don't know who they really were or what happened to them. It's because a lot of them used fake names and were based in Russia, so it's just really hard to trace. But one high-ranking person within Conti, we do know, it's Stern, the Trickbot commander who was in charge when Conti absorbed Trickbot. German police and international prosecutors identified Stern as Vitaly Kovalev, a Russian national in his late 30s. The European Union, UK, and the US all sanctioned him, linking him back to Trichba and Conti, a multinational response that essentially tries to freeze him off from the global economy. He's going to have a hard time using any service that changes his money into dollars or euros.

• 58:29Speaker 00

  He likely can't travel to any country that has an extradition treaty with the US. Vitaly allegedly racked in more than $300 million in ransomware payments. And that's just his own personal cut of the proceeds. But given how long he's been at it, Jeff White says it's possible that he might be a cybercrime billionaire, which would be the first person to become a billionaire from cybercrime. Vitaly isn't someone that you would look at and say, oh, yeah, that's a successful cybercrime boss right there. If you look him up online, you can see his face, and he doesn't look suspicious. He doesn't have a hood or cover hangs. He's smiling, looking serious. He's like the kind of person that if you were lost on the street, you would stop and ask for directions and say hello.

• 59:10Speaker 02

  You know, frankly, you don't look at pictures of Kovalev and think, you know, internet's gangster number one. Now, I don't know how many other of the people you've investigated, Jack, who you would think that about, but he really just doesn't seem the type, which is odd for me to be saying as an investigative journalist. Normally, I'll sort of look at people and go, yeah, I can see you doing this, but Kovalev's somehow not. Of course, the big problem Vitaly Kovalev's got, if indeed he is Stern and did run the Conti gang, is what to do with all that money. Because you'll know, I mean, again, you've done stories on this, you know, Bitcoin, if you've made money in Bitcoin, you've got a big problem in that it's traceable. You know, the big problem, I suspect now, for members of the Conti gang is where to launder that money.

• 59:53Speaker 02

  And actually, what we turned up as part of the podcast was a sort of whole slew of kind of Middle East-based, often Dubai-based cryptocurrency-type operations that people were saying were linked to or seemed to have links to people like the Conti gang and some of the individuals behind that. Interestingly, sort of around the Ukraine war, there was kind of a bit of an exodus of Russians towards Dubai and towards the Middle East.

• 1:00:23Speaker 00

  Conti's rise is both astonishing and tragic. It became the apex predator in the cybercrime world. Its tactics evolved, and that turned into a cash cow. And it became so big that it spawned a network of affiliates who went rogue and put targets on its back. Conti became so big and famous and scary until it became too large to last, a victim of its own success.

• 1:00:57Speaker 00

  Thank you so much to my guests, Alex Holden and Jeff White. Jeff actually has a multi-part podcast called The Conti Files by Cyberhack, which goes into so much more detail about this Conti story. He interviews some really interesting people, and it's worth listening to that. Hey, I just released a whole new podcast. It's called Low, and it is out and available for everyone to go listen to right now for free. Just search your favorite podcast player for Low or go to thisislow.com to find it. This is a story that is so long and twisted that I felt deserved its own podcast. It stands on its own as something truly special, at least I think so. And the feedback I've gotten so far is that it is mind-blowing. It'll make you think differently about your life.

• 1:01:41Speaker 00

  And a lot of people say it should absolutely be a movie. I've never put so much effort into a story before. It took like seven years for me to get this out, so go listen to Low now. Thank you. This episode was created by me, Sir Loin, Jack Rees-Sider. The ping repeater himself, Sean Powers, is who wrote and produced this one. Our editor is the ransom werewolf Tristan Ledger. Mixing done by Proximity Sound, and our intro music is by the mysterious Breakmaster Cylinder. My ransomware negotiator quit on me last week. She said the job had too many demands. This is Darknet Diaries.