180: Conti
00:01 This episode is sponsored by NetSuite. AI isn't just opening new business opportunities. It's changing the way businesses get work done. That's the idea behind NetSuite Next. The next generation of the Business Management Suite, trusted by over 44,000 companies with AI woven into every tool you already rely on. NetSuite Next surfaces insights when you need them, puts agents to work on routine tasks and problems.
00:26 It's the service that I would use if I needed it. And if you want ideas for what else it can do for you, experts have created a business guide called Aligning for the Agenic Era, how AI is changing everyday work. And right now, it's a free download and see how AI could reshape across your organization and how you can prosper from it. If your revenues are at least in the seven figures, go to netsuite.com slash darknet, get your free guide at netsuite.com slash darknet. NetSuite.com slash darknet. NetSuite.com slash darknet. There's a kind of silence that follows a ransomware attack. Your throat gets dry, your chest gets a little heavy,
01:10 and everything around you goes silent, especially when you see text like this flash across your screen. All of your files are currently encrypted. If you try to ignore us, we've downloaded your data and already to publish it. You don't know who's on the other side of that ransomware note, or just how much damage they may cause if you don't pay up. The most fearsome enemy is the one, You can't see. That silence, pulsating fear can be deafening as it creeps across hospitals
01:37 trying to treat patients or business owners trying to make payroll or teachers running a class full of kids. The time is almost over. We need your decision. If we don't receive any reply to this message, we begin publishing your data. Conti is here to prevent any further damages. For years, there was a group that called themselves Conti. and they wreaked havoc across the internet. Conti is here to prevent any further damages. Hackers operate behind a curtain, known mostly by the destruction they leave behind. We rarely hear or see them.
02:15 They want to remain covered up in the shadows under the guise of codes and keystrokes, but what happens when that curtain gets yanked? And suddenly their deepest, darkest secrets are exposed for the whole world to see. Not just their threats against us, but their arguments, their insecure. and fears. These are true stories from the dark side of the internet. I'm Jack Recyder. This is Darknet Diaries.
02:49 This episode is sponsored by Threat Locker. The weird part about modern cyber attacks is how normal they look. The attacker logs in from Chrome, uses PowerShell, runs a remote admin tool your IT team already trusts. There's no custom malware, no dramatic movie hacker moment, just normal tools used. in the wrong way. That's part of why Threat Locker exists. Threat Locker helps organizations control what software can run, what it can do, and how systems communicate. If attackers get credentials or land on a machine, they'll have a much harder time moving through the environment because security teams are realizing something important. The problem isn't always unknown
03:43 software anymore. Sometimes it's trusted software, being used by the wrong person. If you want to see how Threatlocker works, go to Threatlocker.com slash Darknet. book a demo today. That's Threatlocker.com slash darknet to book a demo. This episode is sponsored by my friends over at Mays. GitHub saw nearly a billion commits last year. This year, with AI agents writing code, they're on pace for $14 billion. Code is shipping faster than ever, and its vulnerabilities are piling up just as quickly. Legacy S-EA and S-A-S-T tools weren't built for this kind of scale. That's why Mays, launched Mays Code. They're using AI agents to investigate every vulnerability in your
04:33 dependencies and in the code your team writes. The agents use context from your code and cloud to prove what's really exploitable in your environment, not just theoretically risky. Then they go further, catching the business logic flaws, other tools miss. And when something's exploitable, they find the fix and send it straight to the right developer or your coding agent. Check out Maze at MazeHQ.com slash darknet. That's Maze spelled M-A-Z-E. MazeH-Q dot com slash darknet. When I think about the lifespan of a Russian cyber gang, there's an image that comes to mind. It's that Russian nesting doll, you know, those wooden dolls that stack together. They stack inside each other. They start small and then they get bigger and bigger and bigger.
05:21 Russian hackers kind of operate in the same way. One tiny group starts it. They're at the center. and then they develop more and more layers around them. They get bigger and more influential and can rack up millions of dollars and leave a trail of destruction. These Russian cybercriminals seem to be untouchable by the Western authorities. The FBI and Europol can't go into Russia to arrest them,
05:42 but they can issue arrest warrants for them in case they trip up or fly somewhere outside of Russia. They might get arrested. But you might think that when the cybercriminal gets arrested, it's all over, right? Well, not exactly. Like those nesting dolls, when a cyber gang forms an outer shell, it forms into something else,
06:00 sometimes something even more sinister. And it keeps happening over and over until there's splintering cells, each one learning from the other, each one working together. And that's how I think about Conti, one of the most successful ransomware gangs in history. But before I get into Conti, let's back up a bit and take a look at where they came from. Before them were other ransomware groups. There was the Dyer gang and there was TrickBot.
06:24 An essential person in both of those was a Russian crime boss who went by the name Bentley. Bentley was an entrepreneur at heart and found creative ways to launder his cybercrime profits. In order to securely access profits from cybercrime, this Bentley character created side hustles to launder his cybercrime profits. It's a hard problem that hackers have to figure out all the time. How do you turn ransomware payments, stolen credit card data, or crypto into something you can buy without leaving a paper trail? It's where the business of illegal hacking meets the real world. And Bentley's big idea was to use his proceeds from the dire ransomware gang to create a film production company.
07:07 I guess his idea was that if he can make a film with dirty money, and then that film makes actual money, then that money is clean. They wind up with so much money that they needed some vehicle through which to wash the money. That's Jeff White. He's a good friend of the show. He's an investigative journalist out of London, and he's been reporting on some of the world's most prolific hackers from the U.S. to North Korea to Russia. And he hosts a new BBC podcast on Conti called The Conti Files.
07:32 Jeff says Bentley's film production company was called the 25th Floor Film Company, housed in a skyscraper in Moscow. Now, this wasn't just an idea of Bentley's. They were making actual films. Obviously, they have to make some films, because if you can have a front company, it's got to actually do some of the work that the front company is supposed to be doing. So they thought, well, what films should we make?
07:53 They worked on some movies and television shows in Russia and surrounding countries, and they also produced action films with A-list American stars. Like there was this movie called Exposed, starring Kiana Reeves, which was made by them. Nobody's talking. I don't blame him. He's dead. He's dead. She's dead. But somebody knows something. And Bentley knew all the ins and outs of the cybercrime underworld.
08:17 And he had a film production company, And this made him start to think. And hilariously, they decided they would make a film about a group of Russian computer hackers, which was going to be called Botnet. And this film they were going to make, when I spoke to the screenwriter, a guy called David Kaplan, who was recruited in Hollywood.
08:37 Some Russian guys came up to him at a party and suggested he might like to write this film. And then when he starts researching it, he went over to Russia to meet the film company, not realizing that the very building the film company was based in was also the same building where the hackers were working on this malware. And they described the plot to him, and they sort of said, well, there's going to be this guy in charge, going to be sort of big ball guy, and it's going to be this smart number two guy,
09:00 and then there's going to be a glamorous woman. And all of these people were actually real characters, real people, in the dire gang. You know, Bentley, the guy who went on to become stern, who went on to run Conti, was going to be one of the characters in the film. And apparently they had a plan that they were going to come across to Hollywood and actually shop this around and try and get some funding for it. So it's just, I can never get over this. In order to launder the profits from cyber crime,
09:25 they created a film company, and then we're going to use the film company to make a film about the same cyber crime they were using to make the profits to launder through the film company. I mean, it's just, it's genius in a way, evil genius. A critical rule in the hacker underground is don't docks yourself. It's really rule number one. If you're doing cyber crime,
09:43 you've got to use fake names, fake addresses, burner emails, or burner phones. You can't trust anyone you're working with because if they know who you are and they get compromised, now suddenly you're compromised too. The best operators in the world are the ones you've never heard of. Silence is their shield. People in this world who can't resist telling their stories
10:02 are often the first to get caught. So it's wildly surprising that Bentley, and even the people around him and the Dyer gang, were thinking about making essentially a documentary about their ransomware gang. But in the end, Bentley never reached his dreams of making his big break with this movie Botnet. Those dreams came crashing down at the end of 2015.
10:25 Now, tragic end to the 25th floor film company and indeed the Dyer Gang. They actually got raided by the Russian authorities. We don't know why. Clearly they fell foul of the Russian authorities somehow. Off the back of that, out of the ashes of that, emerges a new group. Now that group initially called TrickBot starts to morph as they use ransomware. and the ransomware strain that they use,
10:50 because there's different types of ransomware. The ransomware strain they used was called Conti. So eventually the diegang becomes Trickbot, and eventually TrickBot's known as Conti, and from then on, they're just known as the Conti gang because they're using Conti ransomware to infect victims. And now you're starting to see these Russian nesting dolls stacking up, one on top of each other, layers upon layers in the group,
11:08 and within all these variations of hacking gangs, leaders like Bentley learned how to recruit other members of this growing empire. It's astonishingly astute and driven, an organized group of people. And as you say, recruiting was a key part of it. You know, they were able to recruit people through Russian sort of job seeker sites. They were obviously very cagey about what the operation was. They would say, do you want to join a, you know, a fast-moving startup? And one of those early hires was a Latvian computer programmer who went by the name Max.
11:40 Now, when I first heard that there's a computer programmer in the Conti Gang named Max, The first thought I had was, of course there is. Max is a very popular classic hacker handle. This guy's probably watched too many hacker movies, and he probably wears hoodies and has his computer that's got LEDs inside the case and stuff. But actually, this Max is opposite of what I pictured. Max is chatty, middle-aged, and a woman from Latvia, a mom even. Her actual name is Alavita.
12:09 She spoke with a journalist, and the BBC translated her responses. A long time ago, I graduated from... from Latvian State University. Max grew up in the 1980s in Soviet Union and managed to pick up coding work in Russia. Max has a degree in applied mathematics and wanted more than anything to become a computer programmer. She got married, had kids,
12:28 and moved all the way to the tiny country in South America. There I continued to work with Russians, but it was all uncertain. From one project to the next, I wanted more stability and didn't want to work alone, just my client and I. So if she's looking for a job,
12:43 Computer programming is what she always wanted to do, and she comes across a talent boot camp for coders. I attended this three-day webinar. Your CV kind of goes into circulation, and the potential employer can come across it and even reach out with some kind of invitation. Max sends her resume, and someone responds to see if she wants to join their company. She didn't ask a lot of questions about who this company was,
13:06 and she didn't get a lot of information, because Max thought that's just how it goes in the land of coders. As part of the job application, she was asked to take a test. So I said that I would take this test. It was quite complicated, but I solved everything and sent them a link so they could see the results. And the week after, they write back to me, OK, you've passed the test. When can you start? And I'm like, if you want, write today.
13:30 She gets the job and starts getting to know her co-workers. Everyone is remote. Now, remember, Max is living in South America, so it feels a bit isolating. There's some water cooler talk over Jabber Messenger, but something feels off. None of her coworkers are using their actual names. Instead, they're using strange nicknames
13:49 like Professor or Snow White or Adelina, simple random nicknames. And then there was one other thing. No one on the team wanted to do a video chat with her. I asked if we wanted to Skype, but they said that they were just chatting. I like good jokes.
14:07 That's why I wrote ironically in the mail. Ah, maybe you're the kind of hack. you hear so much about? He answered me. No, we are not hackers. But soon enough, she learns the truth. Her boss gives her a link to a page that had some wording on it. She's told to use what was on the site as a template for other sites. And that's all she knows.
14:28 The page loads. She sees the gears turning, turning. Max stares at her screen, scrolling text comes across it, and it starts to come into focus. There was text. Your computer is infected, blah, blah, blah. so pay money. It's a template for a ransomware note.
14:47 This was the first time. Max realized she's not just a computer programmer for some tech company. She's a programmer for a cyber criminal enterprise, where at the center was Bentley, who had pieced it all together from the rubble of the 25th floor film company. This is the moment where Max goes from being an innocent computer programmer to knowingly being part of an international cybercrime syndicate, which has to be some decision, right?
15:13 Like, when you realize you're infecting the world with ransom, where do you say, oh, no, that's against my ethics, or do you just shrug your shoulders and say, you know what, it's a good pay, why not? At that point, she decides to stick with it. And actually at that point, she's living very far away from home. She was living actually in Suriname in South America. I think she felt like she was very far away from any risks maybe there. She felt she was just working.
15:39 By this point, she realized she's working for, a ransomware gang. But I think she felt quite insulated. And also felt that her role was fairly junior within this. It's a classic thing where I think she justified it to herself of, well, you know, I'm not really doing any hacking. I'm just doing some coding for them. Over the years, Max became a bigger and bigger part of the ransomware operations.
15:59 While her focus is web design and web development, investigators said because of her language skills, she was able to help write ransomware notes. Now, Max wasn't massively great at operational security. because she ended up hosting some of the Conti ransomware code apparently on her own website in her own name. Alavita is her name. And had also done some YouTube videos at the time, so it was also identifiable from those.
16:26 It could be that her security was rubbish, or it could be that she just didn't realize how at risk she was. This was the early stages of the Conti ransomware group forming, and they had already began infecting systems and getting paid when somebody wanted the decryption key, which of course was starting. to draw attention of the U.S. authorities. They began investigating who's behind Conti,
16:46 which led them to Max, and soon they discovered her real name was Alavita, and they found that she was living in South America. They found out that she actually overstayed her visa while in South America, and so the U.S. authorities worked with the local authorities there to find her and get them to fly her home to Russia because she overstayed her visa. But they purposely put her on a flight to Miami, to make her connection to Russia,
17:13 and when she landed in Miami, she was arrested by U.S. authorities. This was the first person to go down in the Conti group. They were charging her with her involvement with TrickBot and Conti. At this point, TrickBot was working closely with the Conti Ransomware gang, and soon they would merge together.
17:31 Conti was going to acquire TrickBot. And Conti ransomware was becoming sort of a service where you could be an affiliate of theirs. You could use the Conti Ransomware to infect a network's somewhere, and then once infected, the Conti team would then take it from there, negotiating payment, handing over decryption keys, etc. And then the affiliate would get a cut of it. A few months after Max's arrest, hackers using the Conti ransomware launched a devastating attack that put Conti
17:57 on the map of the world stage. In the early days of the pandemic, someone burrowed their way deep into Ireland's hospital network. The initial intrusion happened when a hospital employee opened a phishing email containing a malicious Microsoft Excel attachment. They clicked it, they opened it, they got infected. That was patient zero. Attackers got in and opened up a back door so they could stay in, and then they began making that infection spread. Dozens of infected machines became hundreds.
18:37 One infected hospital became two, which quickly spread to 10. Thousands of machines were infected. and the infection kept spreading across clinics and offices and more hospitals. Thousands of machines were hit with this ransomware. In total, over 70,000 computers were infected at 4,000 locations. And over 40 hospitals were infected within the Ireland's hospital network. And it just sat there, quiet, waiting for the right moment to lock up all the computers. I sometimes liken it to being a burglary, you know,
19:16 you break into a house, it's dark, you've no idea the layout of the house, and so you just have to kind of keep opening doors, and you hope that the door you open isn't the one into the bedroom where the people who own the house are there with a gun. There is a long process of scoping it out, and of course at any moment you might get caught, your access might be revealed. And after weeks of lurking in the network shadows,
19:39 the hackers struck. Ireland's health service describing this as a significant ransomware attack. people asking how an attack like this could have happened in the first place. There's no doubt it is a vicious and a callous act and will be condemned everywhere by decent people. It was total pandemonium. Ireland's healthcare system was hit with the most devastating ransomware attack they had ever seen by a Russian-based cybercrime gang called Conti. Every hospital in the Irish network felt Conti's attack.
20:11 To keep track of patient appointments and records, clinicians just had to use. use pen and paper like the old days. The attack disrupted COVID and blood work tests. All this, as Ireland was in its third wave of the COVID pandemic. It's longest lockdown yet. This is the middle of a pandemic. And as you say, people in Ireland, they speak their minds, the Irish, and they absolutely hated this. Why would people attack our health service? And particularly during the middle of a pandemic. Maternity wards and pediatric units were thrown into chaos. This is basically an entire country's hospital system being held to ransom in one go. It was absolutely stunning.
20:47 It was unlike anything that they, well, actually we've ever seen before. The information systems behind all these hospitals went into a tailspin, a total scramble. Health services classically do not prioritize IT security because they've got lots of other things to prioritize. And they generally don't think that they're going to be a target for hackers. They haven't been historically. And those patients ended up paying a big price. One person who Jeff actually talked to who lived in Dublin went through a particularly awful cancer treatment, a brain cancer treatment.
21:18 But when the cyber attack happened, she was getting ready for a highly targeted cancer treatment involving lasers zapping the cancer in these precise spots. But with computers down, the doctors had to cancel her appointment. So she had to wait even longer to get her cancer irradiated. Stories like these began to flood through Ireland's hospitals. It was pure chaos. And of course, the Conti group was messaging the hospital saying,
21:41 there's one thing that can make this stop. Money. Just about every hospital in the network got a ransomware note saying, we have ransomwareed your data. If you want to contact us and negotiate, here is the way you do it. The hackers demanded $20 million
21:57 to bring back up the hospital's computers. To make matters worse, the Conti gang said they had stolen over 700 gigabytes of data like patient and payroll records. They were saying, if you want us to delete it, you have to pay. Now imagine you're the one in the Ireland Health Department
22:17 that has to make the call on what to do next. You came into work and you found every screen in the building displaying the same ransomware message. Everyone's files are encrypted. All the computers are down. Your backups are gone. People's lives are literally on the line. And at the bottom, a countdown and a price. Ireland's response? No, we are not going to pay a ransom. forget it. The executives for the Irish Health Service kept in contact with the Conti gang, though. I think they were negotiating the price down, but I also think they were just trying to buy some time
22:52 so that they don't publish the data yet. There was some back and forth between the two of them, while the Ireland Health System tried desperately to get their systems back up and running all on their own. They're desperate trying to work out. How can we decrypt this data without paying the ransom? How can we get hospitals back on their feet? Which are the most important hospitals?
23:10 you know, and you're going to make some hard decisions there, Jack, right? You know, is children's health more important than older person's health? Do you prioritize cancer or you do prioritize some other diseases? You know, these are the kind of decisions they're having to make. They're literally life or death decisions about where you try and apply the help first. There was a calculation apparently made at the rate they were able to decrypt the data, how long it would have taken to decrypt all of it without the ransomware key, the decryption key, and it was in the years, one or two years, to unscramble it all.
23:39 So you're facing these problems month after month, potentially year after year. So the hackers kept going. And of course at this point, you know, frankly, you may as well. You scramble all the data. You're kind of in for penny, in for a pound, or in for several tens of millions in this case. There was a period of several weeks where all of this was going on. The data was scrambled. Hospitals were really struggling.
24:03 The hospitals were getting by, you know, the health professionals, they can get back some test results, but it's a fraction of what they get. and they can continue treatment with some people. But after weeks, the hacker had a surprising change of heart. Out of nowhere, without having paid the ransom, they gave the decryption key over to Ireland and seemingly just left the hospital alone after that. It's still a mystery as to why, but there are some running theories.
24:28 One theory is that there's a Russian embassy in Ireland, and it condemned the attack, even agreeing to support Ireland as it recovered. So the hackers handed over the decryption key so hospitals could recover, but their attacks continued against other places in Ireland. They infected school districts, city government, and businesses. Their demands were always the same. Pay up to decrypt your computers,
24:52 or else we release your data on the dark web. Just in case if you try to ignore us, we've downloaded your data and are ready to publish it if you do not respond. So it will be better for both sites if you contact us as soon as possible. One of their targets in 2021 was this jewelry company, called Graff. It's in the UK and known as the jeweler of the stars. Its clients include Donald Trump, Oprah Winfrey, and David Beckham.
25:20 But the client list is never revealed publicly by Graff. It's actually super secret. They are extremely tight-lipped about who their clients are. But in 2021, Conti broke into the jewelry store digitally and stole a list of all of Graff's clients. This, of course, made Graff panic. and they were extremely upset. The names and phone numbers
25:43 of all their high-end customers has been stolen and in the hands of some cybercriminals, forget about the computers being encrypted. The stolen data was more of a problem now. Conti wasn't messing around. When Graph didn't pay right away, they wanted to show them they were serious.
25:58 So they took a chunk of this customer data and released it. 70,000 graph documents hit the dark web. The solution to ransomware was pretty easy. Back up your data. Because if it scrambled, you can just wipe the computer, reinstall the data from backup, and jog on and not pay the ransom. Of course, the ransomware gangs saw that,
26:17 saw it just a threat to their business, which it was, and invented the idea of what they call double-dip ransomware. Double-dip ransomware. Essentially a cyber attack with two steps, steal sensitive corporate data before encrypting it. It gives the hackers more leverage. Conti demanded the jeweler pay tens of millions of dollars to decrypted systems and to prevent more information.
26:39 from getting out on the dark web. So instead of just scrambling the data, we will steal a chunk of the data and then scramble the data. And if the victim refuses to pay because they've got back-ups their data, we can say, ha-ha, if you don't pay, we will leak this sensitive data. It's exactly what happened to graph. So with Conti, it wasn't the full leak. It would have been, you know, a few hundred pages maybe of data, but in there would have been
27:05 the data of very high-profile clients. And my guess is that Conti scanned the information and thought, oh, look, some famous people here will stick this online as a sort of threat to the Graph group and say, look, if you don't pay the ransom, there's going to be more of this. But Conti didn't look really carefully through the data they were leaking. It was actually too much data for the Conti gang to analyze effectively. In the end, Graph did pay up.
27:29 They paid $7.5 million in Bitcoin. They didn't want the rest of their client list getting out. And they felt like this was the price. they have to pay to keep their customers' records secret. But how much can you even trust this Conti group to be good on their word when they say they'll actually delete it? It must have been so maddening for Graf. But Conti's successful jewelry heist may have been rush, even sloppy. We all make mistakes when we're rushing, and Conti is no different.
27:57 Within the initial breach of customer data leaked on the dark web, Conti unwittingly shared details of purchases of high-profile members. of society. And one of those was the Saudi royal family. That's right. Conti doxed the Saudi royal family. And that did not go down well, it seems, among the Saudi royal family. There are people around the world who you want to offend and people who you really, really don't, and the Saudis are probably very much in the latter category. After the UK's Daily Mail reported on this heist, the Conti gang must have been contacted by someone or threatened or something. things serious happened because Conti published an apology, something you never see from cybercriminals.
28:45 We found that our sample data was not properly reviewed before being uploaded to the blog. Conti guarantees that any information pertaining to the members of Saudi Arabia, UAE, and Qatar families will be deleted without any exposure and review. Our team apologizes to his royal highness, Prince Mohammed bin Salman, and any other members of the royal family. whose names were mentioned in the publication for any inconvenience. Conti said it removed the documents from Graf that it initially leaked online and claimed none of the stolen data was sold on auctions or offered as samples or revealed in any other capacity to any third party.
29:24 Conti guarantees to implement a more rigid data review process for any future operations. Wow, that's really unusual that they retracted their leak. my head starts to go to, okay, somebody had enough wealth and influence to be able to say, okay, let's find out who these people were and go and personally threaten them. Yes. Yes, there was an expert we interviewed for the podcast, intelligence expert. His assessment of this was that the kinds of wealth you're talking about and the kinds of people involved in those leaks. You're talking about the top strata of the world's richest, most powerful people. they have a cadre of people around them
30:08 who look after their security and look after their interests. Those people are very good at their jobs and will make it absolutely clear to a gang like Conti you have done this, there are going to be consequences for you. We have ways of finding you, and if we find you, you're in a lot of trouble and potentially a lot of danger. So there would have been an intimidation of Conti
30:31 to say, take this data down or else. You're not playing here with low players. You're playing with serious people. Now, as I say, we do not know. We're not privy to those emails because they would have been sent and received by the security teams behind these powerful people. But as I say, the proof of the pudding is in the eating.
30:49 We know that Conti issued an apology and we know within the internal conversations within Conti that they absolutely freaked out when this happened and were very worried. In fact, one of the quotes in the Conti gang was, they'll find you and you're gone. So we know that Conti worried internally. We know that publicly they were apologizing.
31:10 If you join the dots, it does really look like somebody got to Conti and said, take it down or else. Wow, that's really surprising to me. I imagine these ransomware groups to be always getting threats from people, right? Just like, I will find you and I will take your children or dog or something. And they just like watching the world burn. So it's just a surprise to see them be threatened in such a way. be scared in some way that the issue an apology and redact their leak.
31:41 They must have been really spooked. And they were on such a role, too. In 2021 alone, they collected over $180 million from their ransomware operations. But I guess Conti was getting their first taste of flying too close to the sun. We're going to take a quick ad break here, but stay with us, because when we come back, these nesting dolls are going to come apart in the most dramatic way possible. This episode is sponsored by Dopple. Protecting yourself from attackers used to be as simple as deleting dodgy-looking emails,
32:15 but with AI, the attack surface has outgrown the defense that legacy vendors provide. Dopple was founded in 2022 to give companies back control. Dopple is an AI-native social engineering defense platform. Dopple strengthens human risk management by training employees to recognize deception and provides digital risk protection across every channel. It even delivers agentic email security that doesn't just score the inbox, but takes down the attacker infrastructure behind the message. Those dodgy-looking emails have been replaced by bespoke and personalized texts, URLs, ads, and even social media connections. But Dopple can then turn these attacks your business receives to inform campaigns and security awareness training for your employees so that they know what to look out for.
33:02 Dopple, outpacing what's next in social engineering. Learn more at doppel.com. That's spelled D-O-P-P-P-E-L-dopel.com. Imagine this. Two Russian hackers are having a conversation. One of them is planning a major attack against, I don't know, a hospital, let's say.
33:25 And the other is in disguise, posing as a Russian hacker. And he's really trying to thwart that attack. The conversations are happening over a dark web forum or on Jabber or Rocket Chat. And sure, conversations with a Russian hacker might start lights like talking about fishing or visiting St. Petersburg's art museums, but then they'll take a turn, shifting to actual criminal secrets.
33:49 Just imagine if you could get a hacker to be vulnerable when their guard is down. What kind of intel could you get about targets or methodologies for attack? Could you turn them away from cybercrime? We find fascinating things on the dark web. We engage with the bad guys. we get inside of not only their systems, but inside their heads. This is Alex Holden. He's a Ukrainian cybersecurity researcher, now living in the U.S.,
34:15 and he runs a company called Hold Security based in Milwaukee. Years ago, him and his team of analysts began infiltrating members of Trickbot, which would go on to get acquired by Conti. Alex and his team talked with Trickbot members, pretending to be Black Hat hackers trying to gain their trust. They weren't buying or selling anything because that is illegal, but they were on a top secret mission. to make connections.
34:38 And that's what Alex does with ransomware gangs, nation-state threat actors or hacktivist movements. You would be surprised, but the bad guy is on the dark web. A lot of them need to talk to somebody. They need a friend. And we create this friend environment for them to start spilling their deepest and darkest secrets. So they're getting some of Trickbot's deepest and darkest secrets
35:00 through its members. They even applied for jobs at Trickbot and tried to move up the chain, and they developed relations. with members to learn more and maybe even turn them good. And we also meddled with some of their perceptions, opinions, even building paranoia for some of them saying that law enforcement is coming for you. And after a while of chumming it up with Trickbot, Alex caught a big break. So one guy, part of Trickbot, decided to give his girlfriend as a present access to Trickbot.
35:32 So this is not like top presents that guys give to... their girlfriend, but he gave access so she can go shopping. So he showed how to find credit cards, how to take virtual machines, stuff like that, and through a folly of errors because we had visibility into her communications, she did not believe in encryption or good passwords or anything like that. She basically disclosed all of it. So that was one of the main advantage points for a while. But over time, we start looking at this and say, okay, here's access to a job server.
36:06 because this girl was given an account and the password was 1, 3, 4, 5, 6. And that's what the admin gave her. But his password just had letter A and end after 1 to 3, 4, 5, 6. Alex's team whittled their way into Trickbots infrastructure, scraping chat logs and eventually cloning the network. And while continuing to make connections with some of the big players in the Trickbot echelon. you know, build a friendship with some of the people, including with Stern. Ah, yes, Stern.
36:40 Remember I told you about that guy Bentley before? He was the one who ran the Dyer ransomware gang, and then he started the 25th floor film company, and then he started the TrickBot ransomware gang, which morphed into the Conti ransomware gang. Well, when it morphed into Conti, he morphed from Bentley to Stern. But at the time, we didn't know who this Stern guy was.
37:01 We only knew that he was one of the nesting. dolls at the center of Conti. At some point, Stern wants to build his own crypto mining platform, and there is a conversation, like 30, 40 pages of conversation about that.
37:17 But this is like, you know, the idea is to sway it from cybercrime to a social angle. Trying to limit Stern's damage. There are a lot of moving parts here. A lot of sleepless nights where Alex and his team was glued to chat
37:32 reading chat forums. They watched TrickBot starting in 2019 and continued as TrickBot got acquired by Conti two years later. His team obtained hundreds of thousands of messages. They curated the data, they read through it, and published summaries of the data. What they saw was a criminal enterprise, a lot more organized than any of them even imagined.
37:55 TrickBot was run by Stern as a company. It was not run as a gang. and I'm very used to corporate America. That's the local yet right now, but the company that they run, they had different departments, they had physical offices. They had lunches,
38:13 they talked to each other. They were sympathetic to employees like Alavita who got in trouble. Alavita is the trick-bop member I told you about earlier who was arrested. She went by Max, remember? They even said that they are allocating $25 billion in the first eight months of 2021, I believe, to improve their infrastructure.
38:41 Not every company can afford that much of expansion. They did. So it was budgeting. It was accounting. It was everything. Alex's team also got insight into attacks that were still in the planning stages, attacks against schools, city governments and hospitals. Here's one Conti-Mever. named Target writing about going after healthcare. We got on a video call with them. They offered 18 Bitcoin. Their turnover is 30 million. Let them pay millions.
39:13 Tomorrow we'll make a move that'll make the whole leadership go, please, miss, don't do it. They got used to little old chats and messages over there. 18 Bitcoin. Tomorrow the whole office will rob them. Let them die. Despite this being criminal activity, there are still certain rules that criminal hackers have. Ask enough people in the ransomware underground, and you'll hear that there are certain targets that are just off limits, like hospitals.
39:43 After the Russian hacking group LockBitt targeted a children's hospital in Canada in 2023, it publicly apologized and turned over the decryption key. It didn't know it was a hospital. In the Conti chat logs, you can see internal disagreements about the ethics of going after health care. For example, one Conti member asks the Conti boss, Stern, if he's signed off on encrypting the hospital's data. And Stern responds with, I usually don't approve encryptions. If you didn't approve it, I will hand the decryptor to that clinic. We agreed not to touch the medical sector, remember? This Conti member who's pushing back against going after hospitals messages Stern,
40:21 complaining about their co-worker, someone who goes by the name Dollar. Let's get Dollar out of the game. He's a total idiot. Back then, he screwed me over, claiming he had an agreement with you to mess with the hospital. And now he targeted the hospital again. That's disrespectful. I told him twice that we don't touch the medical sector. At this point, Conti's members and affiliates were in the hundreds. And as it grew, it became more challenging to control hacking operations.
40:49 So it's no surprise you'd get these internal riffs about who to attack. And to make matters worse, Conti was without leadership. The boss, Stern, drifted away from the child. He was just not present very much anymore. My theory is that when you start a new and upcoming cybercrime group, it's exciting, it's fun. But then when things start turning into just handling customer support issues all day long, leaders often lose interest. One of his deputies, someone who went by the name Mingo, got growingly frustrated about this.
41:21 You constantly give me the impression that you don't care. You need to be online more often and in some situations be a bit tougher for discipline. And then by January 2022, researcher Alex Holden says Stern left Conti without a trace. The chat logs just show Conti falling into chaos after that. Listen, Stern has gone missing. No, he's not missing. He'll show up soon. Everyone's looking for him.
41:48 With the boss gone, people started getting worried if anyone was going to get paid. Members weren't quite panicking yet, but it felt like the ground was becoming unstable within Conti. And then, to everyone's surprise, a full-blown war erupted. It was unprovoked, but this is what Russian President Vladimir Putin unleashed on Ukraine. As the sun came up this morning, a missile striking an industrial park in western Ukraine. A helicopter assault on an airport outside of Kiev, close, intense fighting. And there are civilian casualties. And little did we know that Russia invading Ukraine was going to send a shockwave through Conti.
42:37 Many of the members were glued to the news. I hope that Kiev will be ours by evening. But not everyone in Conti was rooting for Russia. Many of Conti members were from Ukraine. The war split a lot of families because some families were living in both Ukraine and Russia and suddenly they were at war with each other. The war completely split the Conti pack. with some of its operators really unhappy about this invasion.
43:01 Friends, brothers, are there any Ukrainians besides me? Madness. Support me, brothers. I mean, I'm just thinking about how can you be thick as thieves with someone and go rob the world of millions of dollars doing cybercrime together and then suddenly go to war with the very people in your own group? Members were torn about what to do. Talking to you directly, your own people. Directly, your posts are painful for the members of our team.
43:29 Emotions and tensions started flaring up in the group chats. Half the Conti gang were saying, Kiv Biden, and the other half were saying, Slava Ukraine. And eventually, Conti, as an organization, took a stand, releasing a statement for the world to see. The Conti team is officially announcing full support of the Russian government. If anybody decides to organize a cyber attack or any war activities against Russia, We are going to use all our possible resources to strike back at the critical infrastructures of an enemy. When that message showed up on computer screens across the world, there was someone who took this note very seriously.
44:10 He was an IT specialist from Ukraine, and this message consumed him with anger. I cannot shoot anything, but I can fight with a keyboard and mouse. In an interview at the time, he told CNN he was prepared to cut deep, deep into Conti where it hurt. We had someone voices responses. It's my country. If the Ukrainian government provides me weapons, okay, I'll go fight.
44:37 But I'm better at typing. This Ukrainian IT specialist had a plan. He wanted to do a data breach on the Conti ransomware gang itself. He thought if he could get into their internal communications, download all their chat logs, see what their network consists of, look at their member information,
44:55 he could expose them in a very devastating way. He started working with Alex Holden and others to try to obtain the Conti chat logs. He was grabbing the chat logs, while other members of the team were reading through them and providing summaries. These messages were private in the Conti network. They were never meant to be released. But he was determined to expose them to ruin Conti. He came to Alex and told him what his plan was.
45:22 He talked to me ahead of time. We talked about how to do this properly, and it turned out the way it did. I had no control over it. I did tell him that he needs to think about it. But from legal perspective, it was not our data. And from more perspective, I'm also from Ukraine, and I completely understand him and his actions. You have to understand that in the first days of the Russian invasion into Ukraine, Conti stated that they fully support the cause of Putin.
46:13 And my friend, as a Ukrainian citizen, Ukrainian national, felt that this is his way not to pick up a weapon and defend his homeland, but something to do bigger against the aggression from Russians. Then about a week after the invasion, the Ukrainian analyst had infiltrated Conti deep enough and gathered enough incriminating data that he thought it was time to start leaking the data.
46:45 He created a Twitter account called At Conti Leaks, Which it's very ironic to breach and expose a company who's in the very business of breaching and exposing companies, right? Here's what the first tweet said. Greetings. Here is a friendly heads-up that the Conti gang has just lost all their shit. Please know this is true. Now there's been speculation from researchers and journalists that the leaker may have been a disgruntled former Conti member. The truth is we aren't exactly sure who the leaker is.
47:15 But Alex Holden says he knows. He says the Conti Leaker is a computer specialist who at the time of the leaks was a consultant for his company and continues to live in Ukraine today. Regardless of who he is, he released the holy grail for cybersecurity analysts, researchers and journalists who were studying this gang. The contents of the first dump contained the chat communications, current as of today and going to the past, of the Conti ransomware gang. We promise it is very interesting. There are more dumps coming. Stay tuned. Thank you for your support. Glory to Ukraine. Over several data dumps, there were tens of thousands of internal messages released.
48:01 There were conversations about planning attacks, names of members, pictures of members, and details about the organization structure of Conti, which was surprisingly hiding in plain sight. But there were also nuggets that were meant to strike deep into Conti where it hurt. Like the cryptocurrency accounts used to steal millions of dollars in ransomware payments or discussions about going after journalists reporting on the poisoning of the Russian opposition leader Alexi Navalny. Alex Holden says before the logs were released, there was information excluded for safety reasons. But he says nothing was altered.
48:35 My goal in cyber threat intelligence is to help victims and help victims as effectively as possible. So, you know, he did what he did, and he changed the world. We changed the world one victim at time. He did something bigger. Because in this situation, Conti was a victim of a database. So this whole thing is like flipped on its ear. I don't think we've ever seen a data breach like this before, where the hackers got hacked.
49:04 I don't think it was the right thing to do. the Conti shattered in many different groups and the members became part of many other ransom groups that start multiplying
49:20 the crime and losing visibility actually increased number of victims. Alex Holden says even though he wouldn't have publicly released the logs the disclosure changed the Conti gang
49:31 in profound ways. How many Trickbott and Conti operatives been unmasked since. How many of them were indicted? How many of them are on wanted lists for us from law enforcement perspective?
49:46 I remember when these leaks came out. It was quite a moment, if you were on Twitter at the time. We all got our popcorn out and was just watching the cyber gang unravel in real time. The nesting dolls just kept opening one after another, and we had no idea how many would just keep opening. It was just wild to see one open after another. People were being exposed.
50:08 left and right. There were pictures of the Conti gang going around. Soon there were memes about the members. Like surprisingly, there was a half dozen women who were members of the Conti gang. And so you'd see posts like, these are the women of the Conti ransomware gang. And lots of photos were shown of just them. Driving in cars,
50:24 eating lunches, passports, photos of them. Many of them were looking like they were part of the world of luxury. It felt like the lid of this shadowy, dark underworld just blew off in an instant. There was such a rare glimpse into one of the most successful ransomware groups of all time.
50:41 Twitter was having a field day. This wasn't your typical white paper right up on some ransomware group. This had drama. This had intrigue. This had dirt and scandals. And I even posted a meme which said, Infosec, we know drama. Just reading through the chat logs,
50:58 you see all kinds of infighting. You can tell that something catastrophic is going to happen soon. A lot of us were just sitting back in our chairs like, wow, season one of this show is amazing. investigative reporter Jeff White grabbed a front row seat. When this came out, I think there was all this stuff about cyber attacks around Ukraine, trying to keep abreast of all of that. Then these Conti leaks come out.
51:19 It's 70,000 messages, Jack. It was an absolute nightmare. They're all in Russian. They're in Cyrillic characters. They're in hacker slang. So you've got to try and start translating them. And then immediately afterwards, you get this second huge dump information. It's even more messages.
51:36 You read 47. thousand of these messages? Yes, yes, yeah, I did. Amazing. The thing about the leaks is it's thousands of messages. They're all in Russian. They're all in Cyrillic characters. And obviously you're thinking, a lot of the listeners will be thinking, well,
51:48 sticking in one of these LLMs, you know, let the AI do the work. LLMs do not deal well with Cyrillic alphabet. So there's loads of mistranslations. So one of the things they keep talking about in the leaks is the cubals. Who's got the cubals? Like snooker or pool or, you know. And I couldn't understand this. and then I realize that if you take the Russian translation of Bitcoin,
52:09 but the N at the end, because it's in Cyrillic, looks a bit like a V, so the translation engines to translate as Bitkov, which in Russian is Kubol, Bitkov, K-Bol. And so whenever they're talking about the kubals, it means they're talking about Bitcoin. So immediately you start to kind of understand there's a code almost in the translations. The other thing they kept talking about was the toad, as in like the reptile, like, why is the toad slow? and I've got problems with the toad.
52:36 And I couldn't understand why they kept talking about the toad. And it turns out this was the software they were using to communicate was Jabba, which in Russian is Haber. And Chababar translates as toad. So they keep talking about the toad, and you realize they're talking about the Jabber thing being slow. As you're reading through these messages, you have to go through them by eye, I think, one by one,
52:57 because only then you get the hang of what is actually being discussed. Okay, so after the leaks came, out and we start to see the inner workings of how this Conti ransomware gang is operating, do they skitter, do they run away, do they hide, shut up shop, or what happens to them? So in terms of what happened next to Conti, we know that the gang apparently disbanded, and we know that there was talk in the chats of, well, you know, it's coming to an end, just go off and, you know, rest for a little while, we'll regroup. People who track these things are pretty sure that very, very,
53:36 various affiliates from Conti just became affiliates for other gangs. There's some suggestion that Conti members set up other ransomware groups, just crossovers with code and so on. So the thing splinters and it fractures. But there's this amazing moment where they decide someone somewhere within Conti decides they're going to go for one last big takedown, and they're just going to do an absolute showstopper. And that's when they decide they're going to hit an entire country.
54:00 They're going to hit the government of Costa Rica. Late today, we learned that Costa Rica has declared a state of America, emergency after a ransomware attack. Sounds very serious. The group Conti, the company assuura if it's to tryer information sensible.
54:16 I was very terrified for us. Over 30 government organizations were compromised by that campaign. Like, we didn't know what to do. And exposed citizens'
54:29 personal information. So it's not clear how they're going to resolve all this. Yeah, Costa Rica declared they're at war with Conti. How about that? Nobody was expecting. this as the next step from Conti,
54:38 especially after they just got exposed, about two dozen different government organizations were targeted, and many sectors came to a screeching halt. This was a big deal for Costa Rica. The first thing that was hit was Costa Rica's treasury. One of the big ramifications of that was importing and exporting of goods, and all that's run digitally. So that just collapsed,
54:58 and they had to go back to pen and paper, but Costa Rica was not ready for that. A large chunk of the country's money just got cut off because imports, exports just grinded to a halt. There were also disruptions with paying salaries and pensions for government workers. In the end, the sort of solution they came up with was, anybody who got a pension last month, gets another pension this month, you know, just pay people again and I hope we sorted out later.
55:20 So they did manage to get around that. There was also political consequences. This attack happened right in between a change of presidential administrations, and it fed into the whole campaign against the existing government, like, of course they're incompetent. They couldn't stop this cyber attack. It sort of fed into this sense of, you know, a country that was kind of on the edge. As the government started looking at this and refused to pay Conti, Conti upped the ante
55:45 and attacked more parts of the government, more government departments. I think the Science and Technology Department got attacked. And in the end, there was various local government websites that got taken down. As I said, you got this pile-on effect where other gangs and other cyber criminals started to get involved. And the Conti government was in the end fighting. fires. I mean, they were probably in the dozens of attacks, some much bigger, you know, like the treasury and so on, some much smaller in terms of local government institutions. But it really was a pandemonium. It happened at this time of a transferring government when Costa Rica was
56:16 particularly vulnerable. The incoming president treated this like it was a national emergency. And like a wildfire, the vulnerability spread across government organizations. Some systems were infected through fishing emails, while for others malware was just put right on them right from the internet and something became clear. Maybe this wasn't just Conti. As the attack went on, other cyber crime groups, other ransomware groups emerge and also started attacking Costa Rica. So it was kind of a pile-on. So Conti were there, definitely. But the effects of the Conti gang got amplified as the attack unfolded over weeks in Costa Rica. Yeah, I don't know if it matters or not, but we don't know if it was the Conti ransomware gang that actually picked their targets or if it was their official.
57:01 that pick the targets or a mix of both. Precisely. I mean, you know, Conti had so many affiliates by this point. And those affiliates would, of course, all have had access to the encryption software, the ransomware software. And so even if the central core Conti group dissolved, it strikes me as possible, certainly technically, that somebody could have retained that encryption software.
57:25 And if they're an affiliates and are good at getting it into a network and infecting a network, there's no reason why they couldn't have used the Conti sort of ransomware without the core Conti gang being aware of it, approving it, or even still being in existence. This could have been an entirely single affiliate-led job, I think, for my technical understanding, that's certainly possible. Another possibility, Jeff says, is that this was a former member of Conti that was just flexing their muscles saying, hey, I came from Conti and I did the Costa Rica attack. Imagine what else I can do. And we know for sure that Costa Rica got hit by Conti ransomware, but that was the
58:01 last incident we ever saw of the Conti ransomware. Because after that, arrest started happening. Certain low-level members of Conti and Trickbont were getting nabbed. Conti seemed to be done. Too much had been exposed. The war tore the members apart and stern their leader was still missing from daily operations. But the affiliates that were helping spread the Conti ransomware, many of them probably just joined other groups. There were loads of other gangs recruiting. If you say, look, I was with the Conti gang, I managed to get a couple of high-profile targets, you know, can I work with your ransomware as an affiliate? You're likely to get a job elsewhere. In terms of the core Conti gang, we don't know what happened with them. The suspicion is they went on and formed other groups.
58:49 The fact is many of the Conti members who appeared in the logs, we don't know who they really were or what happened to them. It's because a lot of them used fake names and were based in Russia. So, It's just really hard to trace. But one high-ranking person within Conti, we do know. It's Stern, the Trick-Bot commander who was in charge when Conti absorbed Trick-Bot. German police and international prosecutors identified Stern as Vitalikov, a Russian national in his late 30s. The European Union, UK, and the U.S. all sanctioned him, linking him back to Trick-Bot
59:20 and Conti, a multinational response that essentially tries to freeze him off from the global economy. He's going to have a hard time using any service that changes his money into dollars or euros. He likely can't travel to any country that has an extradition treaty with the U.S. Vitaly allegedly racked in more than $300 million in ransom repayments. And that's just his own personal cut of the proceeds. But given how long he's been at it, Jeff White says it's possible that he might be a cybercrime billionaire, which would be the first person to become a billionaire from cybercrime. Vitaly isn't someone that you would look at
59:58 and say, oh yeah, that's a successful cybercrime boss right there. If you look him up online, you can see his face. And he doesn't look suspicious. He doesn't have a hood or coverings. He's smiling, look and cheer. He's like the kind of person that if you were lost on the street, you would stop and ask for directions and say hello. You know, frankly, you don't look at pictures of Kovlev and think,
01:00:16 you know, Internet's gangster number one. Now, I don't know how many other of the people you've investigated Jack, who you would think that about, but he really just doesn't seem the type, which is odd for me to be saying as an investigative journalist, normally I look at people and go, yeah, I can see you doing this, but Kovlev's somehow not. Of course, the big problem Vitali Kovlev's got,
01:00:37 if indeed he is stern and did run the Conti gang, is what to do with all that money? Because you'll know, I mean, again, you've done stories on this, you know, Bitcoin, if you've made money in Bitcoin, you've got a big problem in that it's traceable. You know, the big problem I suspect now for members of the Conti Gang is where to launder that money. And actually what we turned up as part of the podcast was a sort of whole slew of kind of Middle East-based, often Dubai-based, cryptocurrency-type
01:01:08 operations that people were saying were linked to or seemed to have links to people like the Conti Gang and some of the individuals behind that. Interesting, around the Ukraine war, there was kind of a bit of an exodus of Russians towards Dubai and towards the Middle East. Conti's rise is both astonishing and tragic. It became the apex predator in the cybercrime world. Its tactics evolved, and that turned into a cash cow. And it became so big that it spawned a network of affiliates who went rogue and put targets on its back. Conti became so big and famous and scary until it became too large to last, a victim of its own success.
01:01:51 Thank you so much to my guests, Alex Holden and Jeff White. Jeff actually has a multi-part podcast called The Conti Files by CyberHack, which goes into so much more detail about this Conti story. He interviewed some really interesting people, and it's worth listening to that. Hey, I just released a whole new podcast. It's called Lo, and it is out and available for everyone to go listen to right now for free. Just search your favorite podcast player for Lowe, or go to this islow.com. find it. This is a story that is so long and twisted that I felt deserved its own podcast. It
01:02:33 stands on its own as something truly special. At least I think so. And the feedback I've gotten so far is that it is mind-blowing. It'll make you think differently about your life. And a lot of people say it should absolutely be a movie. I've never put so much effort into a story before. It took like seven years for me to get this out. So go listen to Low Now. Thank you. This episode was created by Sir Loin, Jack Reesider. The Ping Repeater himself, Sean Powers, is who wrote and produced this one. Our editor is the Ransomwarewolf, Tristan Ledger, mixing done by proximity sound, and our intro music is by the mysterious breakmaster cylinder.
01:03:12 My ransomware negotiator quit on me last week. She said the job had too many demands. This is Darknet Diaries.
There aren't comments yet for this episode. Click any sentence in the transcript to leave one.