A Ukraine-based hacker recently “outed” the Conti ransomware gang. Thousands of chat messages were leaked, and the malware’s source code was published as reported by BleepingComputer.

The attack on the hacker gang was launched after they announced on the dark web that they were siding with Russia. And gave a specific warning to leave the country’s digital structure alone or suffer consequences. 

This was confirmation of Conti’s long suspected Russian ties. But even hacker gangs are decentralized these days. And apparently, there were several Conti affiliates of Ukrainian origin, as well. So, Conti was suffering from outside attacks and internal conflict.

Conti was forced to quickly change its stance with a declaration of “neutrality”. But the hack attacks continued.

The Russian invasion of Ukraine isn’t going well for anyone. And with mounting civilian casualties and heavy sanctions the world is paying attention. Various international organizations and common infrastructure is being impacted.

And with Ukraine calling for hackers to come work for them, the cyber-realm is a battleground. Hacktivist group Anonymous has come to the aid of the embattled nation. And cyberwar has been declared.

Conti ransomware gang devastating attack

The Conti gang now public chats and communications cover a variety of topics.

• Active Directory Enumeration
• SQL Databases Enumeration via sqlcmd.
• How to gain access to Shadow Protect SPX (StorageCraft) backups.
• How to create NTDS dumps vs vssadmin
• How to open New RDP Port 1350

And these tools:

• Cobalt Strike
• Metasploit
• PowerView
• ShareFinder
• AnyDesk
• Mimikatz

After 60,000 chat messages were posted, 107,000 internal communications went public. Then the malware's source code was published. This includes source code for multiple Conti tools. And the hacker group’s administration panel and the BazarBackdoor API.

An archive of the password-protected Conti ransomware encryptor, decryptor, and builder went public. And thanks to efforts from additional researchers the password was cracked, and Conti’s secrets were exposed. During the process, the darknet group became increasingly vulnerable.

Conti damaged image taking a hit

During the process, the darknet group became increasingly vulnerable.

The information can have some dangerous ramifications in international cybercrime. And it’s speculated that new ransomware groups may be launched because of the leaks. The exposed source code can easily be adopted by other threat actors. And after some modifications, it can be returned to vulnerable endpoints.

The future of the once prolific Conti ransomware gang remains in doubt. And it’s speculated that the leak could result in affiliates moving to other hacking organizations. There is a split internally with its Ukraine affiliates.

The Ukrainian leaksters are promising to expose lots of other dirty little secrets on the internet. And allegedly the Conti ransomware gang’s malicious source code is just the beginning.