Conti Ransomware Gang’s Internal Chats Leaked Online After Siding With Russia

Days after the Conti ransomware group broadcasted a pro-Russian
message pledging its allegiance to Vladimir Putin’s ongoing
invasion of Ukraine, a disgruntled member of the cartel has leaked
the syndicate’s internal chats.

The file dump, published by malware research group VX-Underground^[1], is said to contain 13
months of chat logs between affiliates and administrators of the
Russia-affiliated ransomware group from January 2021 to February
2022, in a move that’s expected to offer unprecedented^[2]
insight^[3]
into the gang’s workings.

“Glory to Ukraine,” the leaker said in their message.

The leaked conversations show that Conti used fake front
companies to attempt to schedule product demos with security firms
like CarbonBlack and Sophos to obtain code signing certificates,
with the operators working in scrum sprints to complete the
software development tasks.

Additionally, the messages confirm^[4]
the shutdown of the TrickBot botnet^[5] last week as well as
highlight the Conti group’s close relationship with the TrickBot
and Emotet malware gangs, the latter of which was resurrected late
last year through TrickBot.

A message sent by one of the members of the group on February
14, 2022 goes: “TrickBot does not work. The project was
closed.”

On top of that, the leaker is also believed to have released the
source code associated with TrickBot’s command dispatcher and data
collector modules, not to mention the ransomware group’s internal
documentation.

The development comes as the Russo-Ukrainian conflict^[6] has splintered^[7]
the cybercrime underground into two warring factions, with a
growing number of hacking actors^[8] picking sides between
the two countries on the digital front.

The Conti team, in a blog post on its dark web portal last week,
avowed its “full support” to the Russian invasion, and threatened
to retaliate against critical infrastructure if Russia is hit with
cyber or military attacks.

It, however, later backtracked, saying, “we do not ally with any
government and we condemn the ongoing war,” but reiterated that “We
will use our resources in order to strike back if the well being
and safety of peaceful citizens will be at stake due to American
cyber aggression.”

The ContiLeaks^[9]
saga is part of a wider effort by hacktivists and security allies,
including Ukraine’s “IT army,” to strike Russian sites, services
and infrastructure as a counter to Kremlin’s military strikes. The
volunteer hacking group, in messages shared on its Telegram
channel, claimed that several Russian websites and state online
portals have been felled by a barrage of DDoS attacks.

Separately, a group of Belarusian hackers known as the Cyber
Partisans stated^[10] they staged an attack
on the country’s train network in an effort to disrupt Russian
troop movements into Ukraine, while another group called AgainstTheWest_^[11] said was “standing
against Russia” and that it breached a number of websites and
corporations.

The Anonymous, for its part, also claimed
responsibility^[12] for disrupting the
websites of state news agencies RT, TASS, and RIA Novosti, as well
as websites of newspapers Kommersant, Izvestiya, and Forbes Russia
magazine and the Russian oil giant Gazprom.

If anything, the rapidly evolving cyber war appears to have put
other groups on alert, what with LockBit ransomware operators
posting^[13] a neutral message,
stating “For us it is just business and we are all apolitical. We
are only interested in money for our harmless and useful work.”