On February 27, 2022, three days after Russia invaded Ukraine, someone with access to Conti's internal systems began leaking. First the Jabber chat logs - 60,000 messages spanning more than a year of internal communications. Then source code. Then infrastructure details. The leaker identified themselves as a Ukrainian member of the Conti organization who objected to the group's public statement supporting the Russian invasion.
What emerged over the following weeks was the most complete picture of how a professional ransomware operation works that has ever been made public. Not from law enforcement investigation and court documents, but from the inside - the HR disputes, the salary negotiations, the technical onboarding documents, the internal debates about targets, the customer service procedures for victims negotiating ransom payments. Conti had built a corporation. The leaks revealed that in detail.
Conti's Organizational Structure
Conti operated like a mid-sized technology company with a criminal mission. The chat logs revealed distinct functional teams: developers who maintained the ransomware and its locker components, a OSINT/reconnaissance team that researched potential targets and gathered information needed for initial access, a penetration testing team that conducted the actual intrusions, a negotiation team that handled victim communications and ransom demands, and a "crypters" team that worked to ensure the malware evaded antivirus detection.
The leadership structure was hierarchical. A figure known as "Stern" or "Professor" appeared to be the primary leader, involved in high-level decisions and financial oversight. "Mango" functioned as an operations manager, coordinating between teams and handling HR issues. Several other named individuals handled specific functions. This wasn't a loose collective - it was a managed organization with reporting relationships, performance expectations, and internal conflict.
The Operator Manual
Among the most valuable documents in the leak were Conti's operator manuals - detailed how-to guides for conducting ransomware intrusions. These weren't the work of independent operators improvising techniques. They were corporate training materials, written to bring new affiliates up to speed on standardized procedures.
The manuals covered network reconnaissance with Cobalt Strike, Active Directory enumeration, lateral movement techniques, how to identify and target backup systems (to prevent recovery), how to escalate privileges to domain administrator, how to deploy the ransomware locker across an organization, and how to exfiltrate data for double extortion. They were thorough enough that security researchers described them as essentially complete playbooks for a sophisticated ransomware intrusion.
The existence of these manuals explains why so many Conti intrusions followed similar patterns. The operators were following documented procedures. When the manuals were published, they gave defenders a complete understanding of the expected attack chain - and the specific tools, techniques, and indicators they could use for detection.
HR, Salary, and Workplace Culture
The chat logs contain extensive HR discussions that undercut any romantic notion of the ransomware underground as a meritocracy of elite hackers. There were performance reviews. Employees complained about salaries. Managers grumbled about underperforming team members. New hires were onboarded with formal documentation. There were disputes about who deserved credit for successful attacks and who should receive a larger share of ransom proceeds.
Salaries ranged from approximately $1,500 to $2,000 per month for most members, with higher compensation for developers and senior penetration testers. These are significant incomes in the Russian cities where many members appeared to live, but far below what the total ransom revenue would suggest if distributed evenly. The leadership captured a large share; most employees were on salary rather than commission.
The leaks also revealed that some Conti members were apparently unaware of the full scope of what the organization did. Junior members in specialized roles - malware developers working on specific components, for example - may have worked in relative isolation from the broader criminal mission. This compartmentalization is a defense against exactly the kind of insider disclosure that eventually occurred.
The Russia-Ukraine Split
The immediate trigger for the leak was Conti's statement supporting the Russian invasion of Ukraine. The statement, posted on Conti's public blog in the first days of the war, pledged to use "all possible resources to strike back at the critical infrastructure of an enemy." It was unusually explicit - most cybercriminal groups avoid public political statements. Within the organization, the reaction was not uniform.
The internal chats reveal some members expressing discomfort with the statement while leadership defended it. A member who identified as Ukrainian ultimately decided to act. They had enough access to the infrastructure - likely legitimate access as part of their role - to download the Jabber logs and begin the leak process.
The leak was coordinated. The data was released in tranches, with researcher accounts on Twitter sharing analysis as new material appeared. This was not an accidental exposure - it was a deliberate disclosure operation timed to maximize damage. The leaker's identity was never publicly confirmed beyond their self-identification as Ukrainian.
Connections to Russian Intelligence
The Conti leaks, combined with prior research, provided evidence of the group's connections to Russian state intelligence. Conti's public Russia-Ukraine statement was more than political posturing - internal communications showed members discussing specific requirements from "the customer" that appeared to refer to state-directed tasking.
The TrickBot malware network, with which Conti had extensive overlap, has been associated with Russian intelligence operations dating to the Wizard Spider group. Microsoft, the US Department of Justice, and CISA have all made statements connecting the broader Conti/TrickBot ecosystem to Russian state interests without always specifying the exact nature of the relationship.
Whether Conti was a pure criminal operation with informal or transactional state connections, or a more formal state-adjacent operation that was allowed to operate criminal activities in exchange for services, remains somewhat ambiguous. The leaked documents provide evidence for the former while external intelligence assessments lean toward the latter being at least partially true.
What the Leaks Taught Defenders
The Conti leaks had practical defensive value. The operator manuals allowed defenders to identify the specific detection opportunities in Conti's attack chain. The infrastructure details allowed takedown of active command-and-control servers. The cryptocurrency wallet data enabled tracking and partial freezing of ransom proceeds. CISA published a comprehensive advisory based on the leaked materials that directly translated the operator playbook into detection recommendations.
The more durable lesson was about organizational structure. Conti's effectiveness came not from unusually sophisticated malware or techniques - their tooling was largely the same commodity penetration testing and credential theft tools used across the industry. Their effectiveness came from organizational discipline, documented processes, and specialization. Understanding this reframed ransomware defense: the question isn't only about blocking specific malware signatures but about detecting the multi-stage intrusion process that leads to ransomware deployment, which can be detected through behavioral indicators at multiple points.
The leaks also confirmed what researchers had suspected but lacked direct evidence for: that ransomware-as-a-service operations at the Conti scale were sophisticated enough to be treated as advanced persistent threats rather than opportunistic criminal attacks. The planning horizon, the intelligence gathering, the custom tooling, the targeted backup destruction - this was not crime of opportunity. It was systematic, planned, and professionally executed.
The Aftermath
Conti's dissolution seeded multiple successor operations. Black Basta, which emerged in April 2022 and quickly became one of the most prolific ransomware groups, is assessed to have significant personnel overlap with Conti. Royal, Akira, and several other ransomware groups show technical and personnel connections. The operators didn't stop operating - they rebranded and continued under different names, taking their skills, tools, and network access with them.
No senior Conti leaders have been arrested. Russia does not extradite its citizens for cybercrime. The US Treasury sanctioned entities associated with Conti's network, and the FBI offered rewards for information leading to the arrest of key figures. These measures have had limited practical impact on individuals who remain in Russia.
The Conti leaks remain the most significant insider disclosure in ransomware history and one of the most significant in cybercrime history. They shifted the public and defender understanding of how professional ransomware operations work from speculation to documented fact. That knowledge has made defenses better - but the organizations those defenses protect were dealing with successors to Conti within months of the leaks, using updated versions of the same playbooks.