In late February 2022, days after Russia invaded Ukraine, a Twitter account called @ContiLeaks began dumping the internal communications of the Conti ransomware group. By the time the leak was complete, the world had a nearly complete view of the internal operations of one of the most profitable criminal enterprises in history: organizational charts, salary negotiations, HR disputes, technical tooling, attack playbooks, affiliate contracts, Bitcoin wallet data, and the kind of mundane office grievances that you'd expect from any medium-sized tech company - except this one had extorted over $180 million from its victims in 2021 alone.

The leak came from a Ukrainian security researcher angered by Conti leadership's public statement of "full support" for the Russian government's invasion. It was both a political act and an intelligence windfall. The 60,000+ messages from Jabber chat logs, combined with source code for the Conti locker and its backend infrastructure, gave researchers and law enforcement an unprecedented window into what professional ransomware-as-a-service really looks like when it scales.

The Corporate Structure

Conti operated with the structure and management practices of a legitimate tech company. There was a leadership tier - the core team, believed to be led by a figure known as "Stern" (also "Demon") with operational leadership from "Mango" - and below it a layered hierarchy of full-time employees on salary. The group had dedicated HR, an IT department, a legal/negotiation team, a training program for new operators, and formalized performance reviews. Salaries were paid regularly in cryptocurrency, typically $1,500-$2,000 per month for entry-level analysts, with senior developers earning significantly more.

One of the most striking elements of the Conti leaks was how normal the internal communications sounded. Employees complained about delayed paychecks. Managers discussed onboarding. There were debates about internal tooling and code quality. A developer complained that their bonus hadn't arrived. Another asked about vacation policy. If you stripped the context, these could be Slack messages from any startup engineering team.

The group ran a "penetration testing department" that was responsible for initial access and lateral movement inside victim networks. There was a separate team responsible for locker deployment. A "reverse engineering" team worked on EDR (Endpoint Detection and Response) evasion. Negotiators handled the ransom demands - this was a distinct function, with experienced negotiators coached on psychology, payment platform guidance, and escalation procedures. The negotiation team had scripts, templates, and metrics for conversion rates.

[TECHNICAL NOTE]
The Conti leaks revealed the full technical stack of a mature ransomware operation. The Conti locker itself used ChaCha20 stream cipher for file encryption with an RSA-4096 public key embedded in the build - each victim binary was unique, with the public key baked in at compile time, making decryption impossible without the corresponding private key held by Conti. The locker was built with a custom thread pool for parallel encryption across all drives. It used the Windows Restart Manager API (RmStartSession) to identify and kill processes holding open file handles to files it wanted to encrypt - the same technique used by professional backup and antivirus software. The locker deliberately excluded certain file extensions and directories to avoid crashing the victim machine (you can't collect a ransom from a completely inoperable system). The backend C2 infrastructure used Cobalt Strike beacons for post-exploitation, with Mimikatz/Kerberoasting for credential harvesting, and the group maintained detailed playbooks for lateral movement through Active Directory.

The Affiliate Model and Revenue

Conti operated as a Ransomware-as-a-Service (RaaS) platform, but with an unusual twist: rather than offering open enrollment to any affiliate willing to pay the standard 70/30 split, Conti's "affiliates" were more like franchisees under tight operational control. The core team maintained control of the encryption keys, the negotiation infrastructure, and the data leak site ("Conti News"). Affiliates provided access to victim networks, and the split was negotiated individually - typically favoring Conti's core team more heavily than standard RaaS arrangements.

The group tracked victim negotiations in a shared system. The leaks showed active negotiations in progress, with internal discussions about optimal demand levels based on victim revenue (gleaned from Dun & Bradstreet lookups), cyber insurance coverage (frequently mentioned - Conti specifically targeted organizations known to have cyber insurance), and the sensitivity of the stolen data. For organizations with valuable data, the threat of publication on Conti News was a distinct second lever, deployed when ransom negotiations stalled. This "double extortion" model had become standard across the ransomware industry by 2021, but Conti's internal communications showed how methodically they operationalized it.

The $180 million figure for 2021 was based on blockchain analysis by Chainalysis. The actual number was likely higher - multiple wallets, multiple payment rails, and significant off-chain settlement. The FBI identified Conti as responsible for over 400 attacks against US organizations, including hospitals, government agencies, and critical infrastructure operators. The May 2021 attack on Ireland's Health Service Executive (HSE) - which encrypted virtually all HSE systems and forced hospitals to cancel tens of thousands of appointments - became one of the most visible examples of healthcare ransomware's real-world consequences.

[WARNING]
The Conti HSE attack in May 2021 is a case study in what happens when ransomware hits healthcare at scale. The HSE operated approximately 100,000 devices across hundreds of hospitals and clinics across Ireland. The attack encrypted a majority of these systems, forcing healthcare workers to revert to paper records, cancel chemotherapy appointments, close radiology departments, and divert emergency patients. The initial ransom demand was $20 million. The Irish government refused to pay. Conti, apparently embarrassed by the scale of public outrage over attacking a national health system during the COVID-19 pandemic, provided the decryption key for free - while still threatening to publish stolen patient data unless payment was received. The restoration process took months and cost the Irish government an estimated €100 million. The initial compromise vector was a phishing email that gave the attacker access in March 2021 - two months before the locker was deployed.

The Disbanding and the Successor Groups

The Conti leaks accelerated what was already an unstable situation. The public support for the Russia invasion had alienated affiliates and created law enforcement attention. The leak exposed infrastructure, wallet addresses, and - critically - identified specific individuals within the organization. The US State Department announced a $15 million bounty for information on Conti leadership and key members. The blockchain trails exposed by the leaks gave Chainalysis and law enforcement a map of payment flows.

By May 2022, approximately three months after the leaks began, Conti publicly announced it was shutting down. The Conti brand was dead. But the people weren't gone - they were reorganizing. In a pattern that has defined the ransomware ecosystem since at least 2021, the Conti operation fragmented into a constellation of successor groups. The core team spun off or seeded at least five significant operations: Black Basta, BlackByte, Royal (later rebranded as BlackSuit), ALPHV/BlackCat (in partnership), and Karakurt (data extortion without encryption). Some former Conti operators joined existing groups like Hive and LockBit.

Black Basta in particular became one of the most active ransomware groups through 2023-2024, attacking hundreds of organizations globally and collecting hundreds of millions in ransoms. Its technical tooling, negotiation practices, and initial access methods bore obvious continuity with Conti. The people who built one of the most profitable criminal enterprises in history didn't disappear - they just changed logos.

[IOC]
Key Conti indicators and infrastructure from the leaks: Conti locker SHA-256 hashes varied by build; the locker created ransom notes named "readme.txt" or "CONTI_README.txt" in every encrypted directory. C2 infrastructure primarily used Cobalt Strike with custom malleable profiles over HTTPS to blend with normal traffic; Conti's teams used Tox (P2P encrypted messaging) for high-value communications, Jabber/XMPP for internal operations (the chat platform used in the leaked logs), and Rocket.Chat instances for some project coordination. The group maintained a "BazarLoader" first-stage delivery infrastructure, used TrickBot for initial access in earlier operations, and Anchor malware for high-value targets. Conti News data leak site: contiransom[.]com and mirror domains (TOR hidden services). Bitcoin ransom wallets were unique per victim. Chainalysis identified the primary Conti "treasury" cluster as receiving approximately $180M in 2021. The ALPHV/BlackCat group, seeded from Conti, used the Rust-written BlackCat locker with intermittent encryption optimization.