180: Conti

The episode begins with an exploration of the infamous ransomware group Conti, highlighting its reputation for instilling fear in IT departments worldwide. The story sets the stage for how Conti’s rise and fall are uniquely dramatic, marked by a highly publicized breakdown after internal leaks. The host skims through the group's evolution, noting its significant financial gains — over 180 million dollars in 2021 alone — and how its internal chaos and internal conflicts contributed to its downfall. The narrative aims to give listeners an understanding of how a highly organized cybercrime gang operated behind a facade of professionalism and sophistication, only to disintegrate amid scandals, leaks, and external pressures.

This section traces the roots of Conti back to previous Russian cyber gangs like the Dire Gang and TrickBot, highlighting the role of a Russian cybercriminal known as Bentley. Bentley’s ambition to launder money through a film production company that even produced Hollywood-style movies about hackers exemplifies the bizarrely entrepreneurial mindset of these groups. The narrative describes how Bentley's gang eventually was raided by Russian authorities, leading to the emergence of Conti as a successor, growing in layers like Russian nesting dolls, and absorbing smaller groups along the way. The section emphasizes the organizational complexity and recruitment strategies of these cybercriminals, including recruitment through Russian job sites and the development of a corporate-style hierarchy.

Here, the focus shifts to the internal workings of Conti, featuring accounts of members like Max (Alavitta), an alphabetically unassuming Latvian woman who unwittingly became involved in the gang’s ransomware operations. Max’s story illustrates how seemingly normal professionals get caught up in cybercrime, often justifying their roles as junior or unrelated to hacking. Over time, Max’s involvement deepened, and U.S. authorities eventually arrested her in Miami for her part in the illicit activities. This segment highlights how Conti operated as a well-organized company with teams, chat rooms, and plans for attack, despite being a criminal enterprise.

This segment recounts the devastating ransomware attack on Ireland’s healthcare system, in which Conti played a major role. Amid a global pandemic, Irish hospitals were knocked offline, forcing staff to revert to pen-and-paper workflows and delaying critical treatments. The gang demanded 20 million dollars and stole hospital data, threatening to publish it unless paid. Ireland refused to pay, leading to weeks of chaos, and ultimately, the attackers unexpectedly handed over the decryption keys, possibly under external pressure. The attack’s scope included thousands of infected devices and contributed to widespread healthcare disruption during an already strained COVID crisis.

This part describes the leak of 70,000 internal messages from Conti, which exposed their internal operations, targets, and even personal details of members. The leak was orchestrated by a Ukrainian operative protesting Conti’s support for Russia’s invasion of Ukraine. The data revealed plans for attacks against hospitals, government agencies, and high-profile clients. The leaks caused a massive unraveling of the gang’s structure, divulging internal disputes, members' identities, and financial operations such as cryptocurrency accounts used for ransom payments. The breach profoundly damaged Conti’s reputation and effectiveness, leading to internal chaos and the eventual disbanding. The leaks symbolize an unprecedented exposure of a major cybercrime syndicate.

This section covers the disintegration of Conti following law enforcement and hacker leaks. With their internal chats publicly accessible, many members and affiliates disappeared, rebranded, or joined other gangs. The chaos was magnified by the arrest of key figures like Vitaly Kovalev (alleged leader) and internal disputes over tactics, such as whether to target hospitals. The narrative details how the war between Russia and Ukraine further fractured Conti, with some members supporting Ukraine and others backing Russia, leading to internal sabotage and splits. The final blow was internal leaks, known as ContiLeaks, exposing the gang’s inner secrets, plans, and identities, and resulting in governmental sanctions against its leaders. This comprehensive breakdown signifies the transition from a powerful syndicate to a fractured remnant, illustrating how exposure and internal conflicts led to its downfall.