Experts Expose Secrets of Conti Ransomware Group That Made 25 Million from Victims

The clearnet and dark web payment portals operated by the
Conti^[1]
ransomware group have gone down in what appears to be an attempt to
shift to new infrastructure after details about the gang’s inner
workings and its members were made public.

According to MalwareHunterTeam^[2], “while both the
clearweb and Tor domains of the leak site of the Conti ransomware
gang is online and working, both their clearweb and Tor domains for
the payment site (which is obviously more important than the leak)
is down.”

It’s not clear what prompted the shutdown, but the development
comes as Swiss cybersecurity firm PRODAFT offered^[3]
an unprecedented look into the group’s ransomware-as-a-service
(RaaS) model, wherein the developers sell or lease their ransomware
technology to affiliates hired from darknet forums, who then carry
out attacks on their behalf while also netting about 70% of each
ransom payment extorted from the victims.

The result? Three members of the Conti team have been identified
so far, each playing the roles of admin (“Tokyo”), assistant
(“it_work_support@xmpp[.]jp”), and recruiter (“IT_Work”) to attract
new affiliates into their network.

While ransomware attacks work by encrypting the victims’
sensitive information and rendering it inaccessible, threat actors
have increasingly latched on to a two-pronged strategy called
double extortion to demand a ransom payment for decrypting the data
and threaten to publicly publish the stolen information if the
payment is not received within a specific deadline.

“Conti customers – affiliate threat actors – use [a digital] management panel to create new ransomware samples, manage their
victims, and collect data on their attacks,” noted the researchers,
detailing the syndicate’s attack kill chain leveraging
PrintNightmare (CVE-2021-1675^[4], CVE-2021-34527^[5], and CVE-2021-36958^[6]) and FortiGate (CVE-2018-13374^[7]
and CVE-2018-13379^[8]) vulnerabilities to
compromise unpatched systems.

Emerging on the cybercrime landscape in October 2019, Conti is
believed to be the work of a Russia-based threat group called
Wizard Spider^[9], which is also the
operator of the infamous TrickBot^[10] banking malware. Since
then, at least 567 different companies have had their
business-critical data exposed on the victim shaming site, with the
ransomware cartel receiving over 500 bitcoin ($25.5 million) in
payments since July 2021.

What’s more, an analysis of ransomware samples and the bitcoin
wallet addresses utilized for receiving the payments has revealed a
connection between Conti and Ryuk, with both families heavily
banking on TrickBot, Emotet, and BazarLoader for actually delivering the file-encrypting
payloads^[11] onto victim’s networks
via email phishing and other social engineering schemes.

PRODAFT said it was also able to gain access to the group’s
recovery service and an admin management panel hosted as a Tor
hidden service on an Onion domain, revealing extensive details of a
clearnet website called “[contirecovery[.]ws]” that contains
instructions for purchasing decryption keys from the affiliates.
Interestingly, an investigation into Conti’s ransomware negotiation
process published^[12] by Team Cymru last
month highlighted a similar open web URL named
“contirecovery[.]info.”

“In order to tackle the complex challenge of disrupting
cybercriminal organizations, public and private forces need to work
collaboratively with one another to better understand and mitigate
the wider legal and commercial impact of the threat,” the
researchers said.