Inside Conti: Ransomware Attacks, Royal Data Leaks and the Gang’s Fracture
· 59:18 · Watch on YouTube ↗
Summary
Darknet Diaries examines Conti’s ransomware operations, attacks on Ireland and Costa Rica, and its apology after leaking royal client data. Researchers describe how internal chat leaks exposed the gang and helped fracture its operations.
Key points
- The episode traces Conti’s links to Dyre and TrickBot and describes a corporate-style criminal operation with recruiting, departments, budgets and ransomware affiliates.
- Ireland’s hospital attack began with a phishing email carrying a malicious Microsoft Excel attachment. The resulting ransomware disruption delayed tests and treatments; Conti demanded $20 million and claimed to have stolen over 700 gigabytes of data.
- Ireland refused to pay, and Conti eventually supplied a decryption key. The reason remains uncertain; the episode presents Russian diplomatic pressure as one theory.
- After stealing Graff customer records, Conti leaked documents exposing royal clients and subsequently issued an apology. Suggestions that powerful clients intimidated the gang are interpretations, not independently established facts.
- Alex Holden describes infiltrating TrickBot communications and infrastructure. Following Conti’s support for Russia’s invasion of Ukraine, a Ukrainian specialist publicly leaked internal communications that exposed members and operations.
- Holden argues that the leaks fragmented Conti and reduced researchers’ visibility as members moved into other groups. The episode distinguishes this assessment from the documented exposure of operatives.
- Conti ransomware disrupted Costa Rica’s government, trade processing and payments. The speakers caution that the campaign’s direction by core leaders versus affiliates remains uncertain and that other groups also joined the attacks.
Article Details
- Topics
- [03:03] Conti’s origins in Dyre and TrickBot and laundering cybercrime proceeds
- [08:08] Recruitment, programmer participation and the arrest of Max
- [14:58] Ireland’s hospital ransomware attack and recovery without ransom payment
- [22:00] Graff data theft, double extortion and Conti’s apology to royal clients
- [29:01] Alex Holden’s infiltration of TrickBot and insights into criminal operations
- [37:15] Leadership absence, Russia’s invasion of Ukraine and internal divisions
- [40:25] Conti chat leaks, investigative findings and fragmentation
- [49:01] Costa Rica attacks, affiliate attribution uncertainty and sanctions against alleged leadership
MITRE ATT&CK
T1204.002 · Malicious FileA hospital employee opened the malicious Excel attachment, initiating the infection described in the Ireland attack.T1486 · Data Encrypted for ImpactConti encrypted victims’ files to demand payment, including in the hospital and government attacks discussed.T1566.001 · Spearphishing AttachmentThe transcript describes the Ireland hospital intrusion beginning with a phishing email containing a malicious Microsoft Excel attachment.
People
Alex HoldenCyber-security researcher who runs Hold Security; describes his team’s infiltration of TrickBot, collection of internal messages and relationship with the Ukrainian specialist who leaked Conti communications.Geoff WhiteInvestigative journalist behind The Conti Files who independently interviewed participants and experts and analyzed tens of thousands of leaked messages to investigate Conti’s operations.
Threat Actors
AlavitaIdentified in the transcript as the programmer using the handle Max. Reportedly contributed to ransomware operations and was arrested by US authorities on charges relating to TrickBot and Conti.ContiRansomware group reported to have attacked Ireland’s hospital network and Graff. Conti ransomware was used against Costa Rica, although the transcript leaves core-group versus affiliate direction uncertain.DyreEarlier cybercrime gang described as a predecessor to TrickBot and Conti, with Bentley playing a central role.MaxProgrammer described as knowingly continuing work for the ransomware enterprise after discovering its purpose, including web development and ransom-note work. The transcript identifies Alavita as her actual name and reports her arrest and charges relating to TrickBot and Conti.SternReported leader of TrickBot and Conti, explicitly described as previously using Bentley. The transcript says police and prosecutors identified Stern as Vitaly Kovalev; Geoff White retains uncertainty about that identification.Trickbot GroupCriminal group whose communications Alex Holden’s team infiltrated. The transcript reports that Conti acquired TrickBot and describes overlapping personnel and operations.Vitaly KovalevRussian national whom German police and international prosecutors reportedly identified as Stern, also described as previously using Bentley. The transcript reports sanctions linking him to TrickBot and Conti and alleges substantial ransomware proceeds.
Malware
Countries
Costa Rica[49:43] they decide they're gonna hit an entire country. They're gonna hit the government of Costa Rica.Ireland[15:00] someone burrowed their way deep into Ireland’s hospital network.Qatar[25:50] and Qatar families will be deleted without any exposure and review. Our team apologizesRussia[02:32] the Western authorities. The FBI and Europol can't go into Russia to arrest them, but they can issueSaudi Arabia[25:43] the blog. Conti guarantees that any information pertaining to the members of Saudi Arabia, UAE,Suriname[12:22] from home. She’s living actually in Suriname in South America. I think she felt like she was veryUAE[25:43] the blog. Conti guarantees that any information pertaining to the members of Saudi Arabia, UAE,Ukraine[37:56] Putin unleashed on Ukraine. As the sun came up this morning,United Kingdom[22:06] the UK and known as the jeweller of the stars. Its clients include Donald Trump, Oprah Winfrey,
Industries
Government[21:37] infected school districts, city government, and businesses. Their demands were always the same;Healthcare[16:48] JACK: It was total pandemonium. Ireland’s healthcare system was hit with the mostJewellery[22:00] JACK: [Music] One of their targets in 2021 was this jewellery company called Graff. It’s in