Loading story…
The Russia-linked Conti ransomware group launched a sweeping attack on Costa Rican government networks in April 2022, disrupting tax collection, customs, payroll, and other critical public services and prompting the government to declare a national emergency. Costa Rican officials said at least 27 institutions were attacked and several were severely affected, with the Ministry of Finance among the hardest hit; additional incidents were reported at entities including JASEC, the Sede Interuniversitaria de Alajuela, and the Instituto de Desarrollo Rural. Authorities said data was stolen and progressively leaked, while restoration of key systems took weeks, including the eventual recovery of the customs platform after roughly two months of disruption.
Conti escalated the crisis by raising its ransom demand from $10 million to $20 million, threatening to delete decryption keys, urging public pressure on the government, and later shifting tactics to target large private Costa Rican companies directly. President Rodrigo Chaves said the country was "at war" and alleged that local collaborators were aiding the extortion effort, though no proof was publicly detailed. As Costa Rica sought technical help from international partners and private-sector responders, the U.S. State Department offered rewards of up to $10 million for information identifying Conti leaders and up to $5 million for information leading to their arrest or conviction, underscoring the group's broader record of hitting more than 1,000 victims and extorting over $150 million worldwide.
TTPs, infrastructure, and targeting history in one profile.
13 events from the most recent confirmed update back to the earliest known activity.
By June 24, 2022, Costa Rica had restored its customs platform following roughly two months of disruption caused by the cyberattack. The recovery marked a significant step in reestablishing one of the country's most heavily affected government services.
By May 17, 2022, President Rodrigo Chaves publicly described the cyberattacks as a form of war or cyberterrorism and said 27 institutions had been attacked, with 9 severely affected. He also alleged that people inside Costa Rica were collaborating with Conti and announced a specialized response and assessment effort.
After Costa Rica refused to pay, Conti increased its ransom demand from $10 million to $20 million and posted threats urging public pressure on the government. The group also warned it could delete decryption keys and claimed it sought to intensify disruption.
On May 8, 2022, Costa Rica declared a national state of emergency in response to the ransomware campaign. The move elevated the incident to a national crisis and supported a broader government response effort.
On May 6, 2022, the U.S. State Department announced rewards of up to $10 million for information identifying or locating Conti leaders and up to $5 million for information leading to their arrest or conviction. The announcement explicitly referenced Conti's disruptive attacks on Costa Rican government institutions.
Costa Rican authorities confirmed attempted cyberattacks against the Ministry of Justice and the Junta de Protección Social (JPS). The disclosure showed Conti-linked activity was extending to additional public institutions beyond those previously named.
On April 26, officials said Conti had attacked the Sede Interuniversitaria de Alajuela, stealing data and altering portal content, and had also targeted Inder, which took systems offline for containment. Authorities said the number of affected public institutions had risen to eight.
On April 25, 2022, Conti announced it would stop mainly pressuring the Costa Rican government and instead target large private Costa Rican companies. The group also claimed that 80% of stolen government information had already been released.
By April 24, authorities said Conti had encrypted Jasec's accounting and human resources systems. The disclosure showed the campaign was affecting additional public-sector entities and operational functions.
On 2022-04-18, Costa Rican authorities said they were investigating whether Conti had stolen information from the National Meteorological Institute's email server. MINAE said the probe followed reports that the group claimed to have exfiltrated IMN data and was demanding payment to return it.
Costa Rican authorities reported that an attack on Jasec may have compromised customer or subscriber information. This marked one of the early publicly disclosed impacts beyond central government systems.
Around April 17-18, 2022, Conti began a major ransomware campaign against Costa Rican public institutions. The Ministry of Finance was hit hardest, disrupting tax, customs, and payroll systems and involving data theft.
In February 2022, Conti's internal messages were leaked after the group publicly supported Russia's invasion of Ukraine. The leak gave analysts new insight into the gang's operations, including indications it worked from physical offices in Russia.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
11 references tracked. Mallory keeps watching after this page renders.
swissinfo.ch
Open sourcebbc.com
Open sourcecyberscoop.com
Open sourcedw.com
Open sourceweb.archive.org
Open sourceweb.archive.org
Open sourceweb.archive.org
Open sourceweb.archive.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Conti emerged as one of the most active **ransomware-as-a-service** operations, using spearphishing, exposed `RDP`, and loaders such as **BazarLoader**, **TrickBot**, **IceID**, and **Emotet** to gain access before deploying **Cobalt Strike**, stealing data, and encrypting systems across networks. Security reporting tied the group to more than 400 attacks globally, with victims concentrated in North America and Europe, and described technical tradecraft including credential attacks, shadow copy deletion, service termination, remote `SMB` encryption, and ransom notes named `CONTI_README.txt`. In industrial environments, Dragos said ransomware became the leading cause of compromises in 2021, with **Conti** and **LockBit 2.0** accounting for more than half of observed incidents, while suspected Conti-linked activity was later detected at major automotive manufacturers and suppliers in North America and Japan. Leaked internal chats, source code, and infrastructure data exposed Conti as a highly organized criminal business rather than a loose affiliate network. Researchers identified a core group of roughly 44 members within a wider set of 442 chat handles, with dedicated teams for coding, reverse engineering, OSINT, HR, payroll, and a "**Fire Team**" that conducted victim research, built phishing phone and email scripts, and helped pressure victims during ransom negotiations using tools such as **Shodan**, **SpiderFoot**, **SignalHire**, and **ZoomInfo**. The group’s impact was illustrated by the attack on Ireland’s **Health Service Executive**, where about **80%** of IT systems were encrypted, roughly **700 GB** of data was stolen, and healthcare services were disrupted nationwide before Conti offered a free decryptor while still demanding a **$20 million** ransom and threatening to leak the data.
Aug 15, 2026
Leaked internal communications from the Conti ransomware operation exposed one of the clearest views yet into a major cybercrime enterprise run like a legitimate technology company. Material published beginning on 27 February 2022 after Conti publicly backed Russia included tens of thousands of Jabber messages, source code, infrastructure details, operational guidance, and translated archives shared through public repositories. The leaks showed Conti had structured management, HR, developers, testers, recruiters, support staff, payroll, and defined working practices, with some reporting describing roughly 150 members and others documenting more than 160,000 messages among nearly 500 actors tied to Conti and related operations. Researchers said the disclosures revealed a mature ransomware-as-a-service and double-extortion business that had already become one of the most damaging strains globally, with the FBI previously linking Conti to more than 1,000 victims and over $150 million in victim payments by early 2022. The leaked chats also mapped Conti’s wider ecosystem, showing overlap with TrickBot, BazarLoader, Ryuk, LockBit, Maze, Ragnar Locker, Emotet, IcedID, Buer, Amadey, and other malware operations, while indicating the group often avoided Russian and Chinese targets and may have had links to Russian state interests. Analysts said the disclosures uncovered victim-selection methods, attack infrastructure, salaries, and collaboration patterns, while also creating a proliferation risk by giving other criminals access to Conti tradecraft and code. Despite the exposure, reporting indicated the group continued operations, adapted its tooling and intrusion methods, and may have influenced or re-emerged through later activity such as Monti, underscoring that the leak disrupted secrecy more than it ended the threat.
Aug 15, 2026
The **Conti** ransomware operation faced a major internal data leak after publicly backing Russia during the invasion of Ukraine and warning it would use its “full capacity” to retaliate against Western cyberattacks on Russian critical infrastructure. Researchers and media reports said activists released roughly **60,000 internal messages**, reportedly from the gang’s Jabber server, exposing more than a year of conversations and offering an unusually detailed view into one of the most prolific ransomware groups tied to Russia. The leaked chats were described as shedding light on Conti’s internal structure, tactics, and past operations, including activity linked to high-profile incidents such as the attack on Ireland’s public health service. Reporting also highlighted Conti’s use of the **ProxyShell** exploit in attacks against healthcare targets and the deployment of scripts to disable **Windows Defender** before encryption. The fallout appeared to ripple across the cybercrime ecosystem, with rival ransomware group **LockBit** publicly distancing itself from geopolitics and emphasizing that it was motivated by profit rather than allegiance to any state.
Jun 29, 2026