{"id":45686,"date":"2022-03-11T00:30:30","date_gmt":"2022-03-11T00:30:30","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/analysis-of-leaked-conti-files-blows-lid-off-ransomware-gang\/"},"modified":"2022-03-11T00:30:30","modified_gmt":"2022-03-11T00:30:30","slug":"analysis-of-leaked-conti-files-blows-lid-off-ransomware-gang","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/analysis-of-leaked-conti-files-blows-lid-off-ransomware-gang\/","title":{"rendered":"Analysis of leaked Conti files blows lid off ransomware gang"},"content":{"rendered":"

It was a Ukrainian security specialist who apparently turned the tables on the notorious Russia-based Conti, and leaked the ransomware gang’s source code, chat logs, and tons of other sensitive data about the gang’s operations, tools, and costs. <\/p>\n

Since then, infosec researchers around the globe have been wading<\/a> through this silo of intelligence, which reveals the inner workings of the criminal enterprise.<\/p>\n

“I call this the Panama Papers of ransomware,” Trellix’s head of cyber investigations John Fokker told<\/a> The Record. Trellix is the cybersecurity company previously known as the combined McAfee Enterprise and FireEye.<\/p>\n

Conti, it should be said, has the ransomware business model down to a science. It extorted an estimated $180m last year, making it the most lucrative ransomware operation of 2021, according to the latest Crypto Crime Report<\/a> from security shop Chainanysis. As of late February, Conti’s primary Bitcoin address contained more than $2bn in digital currency, according to a Rapid7 report<\/a>.<\/p>\n

But, as with any business, it incurs significant expenses from paying employee salaries in BTC, and maintaining its infrastructure, according to data security biz Varonis.<\/p>\n