{"id":17463,"date":"2022-02-28T18:53:06","date_gmt":"2022-02-28T18:53:06","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2022\/02\/28\/60000-conti-ransomware-gang-messages-leaked-the-register\/"},"modified":"2022-02-28T18:53:06","modified_gmt":"2022-02-28T18:53:06","slug":"60000-conti-ransomware-gang-messages-leaked-the-register","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2022\/02\/28\/60000-conti-ransomware-gang-messages-leaked-the-register\/","title":{"rendered":"60,000 Conti ransomware gang messages leaked \u2022 The Register"},"content":{"rendered":"

<\/a>\n<\/p>\n

\n

Activists have reportedly leaked the contents of internal chats from the Russia-affiliated Conti ransomware gang as the Ukraine war continues.<\/p>\n

Leaked after the extortionists vowed to support Vladimir Putin’s invasion<\/a> of Ukraine, about 60,000 messages were circulating online today with a message saying “fuck the Russian government, glory to Ukraine!”<\/p>\n

While Reg<\/i> readers should treat the next link with extreme caution (downloading files originating from a ransomware gang is as risky as it sounds), the vx-underground Twitter account is generally regarded as a benign source.<\/p>\n

\n

Conti ransomware group previously put out a message siding with the Russian government.\n<\/p>\n

Today a Conti member has begun leaking data with the message “Fuck the Russian government, Glory to Ukraine!”\n<\/p>\n

You can download the leaked Conti data here: https:\/\/t.co\/BDzHQU5mgw<\/a> pic.twitter.com\/AL7BXnihza<\/a><\/p>\n

\u2014 vx-underground (@vxunderground) February 27, 2022<\/a><\/p><\/blockquote>\n

The file dump is said to contain 13 months of internal conversations from Conti, many of which are in a Cyrillic-scripted language that appears to be Russian if one trusts Google Translate’s rendition. The structure of the leaked JSON files suggests they are from the Jabber chat app, according to Cisco Talos researcher Azim Khodjibaev on Twitter.<\/p>\n

\n

looks like the #conti<\/a> leaks of 2022 are indeed chat logs from jabber accounts between affiliates, administrators and admins. Rejoice CTI analysts and data scientists, it is in json form! #busymonday<\/a> pic.twitter.com\/DiyqNoymsD<\/a><\/p>\n

\u2014 Azim Khodjibaev (@AShukuhi) February 27, 2022<\/a><\/p><\/blockquote>\n

The leaks prompted excitement among infosec pros as the cache, if genuine, would seem to offer unrivalled insight into Conti’s inner workings. To give one example of an incident of interest, last year the WizardSpider criminal crew used the Conti ransomware to lock up the whole of Ireland’s state-run health service, causing months of disruption and millions in damage \u2013 not to say health impacts on Irish citizens \u2013 after a phishing email hit its mark<\/a>. Internal chats from the time of that attack would be invaluable to law enforcement agencies.<\/p>\n

A different ransomware gang appears to have paid full attention to the Conti leaks and declared themselves “apolitical”, or uninterested in publicly backing the Russian government. Given that most ransomware gangs operate openly from Russia with officials (mostly) turning a blind eye, this is a significant development.<\/p>\n

\n