Loading story…
Leaked internal chats, playbooks, and malware samples exposed Conti as a highly structured ransomware enterprise that combined mature intrusion operations with ongoing development of new attack paths. Reporting on the leaks showed the group maintained specialized teams for coding, testing, administration, reverse engineering, and intrusions, relied on Trickbot and Emotet infrastructure, and provided affiliates with detailed guidance for enterprise compromise. The leaked playbook documented heavy use of Cobalt Strike, AdFind, SharpView, SharpChrome, SeatBelt, and GMER, along with credential theft, Active Directory reconnaissance, administrator targeting, and exploitation of CVE-2020-1472 to accelerate domain-wide access.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
18 events from the most recent confirmed update back to the earliest known activity.
Eclypsium analyzed leaked Conti chats showing the group researching attacks on Intel Management Engine and CSME firmware as a route to compromise UEFI/BIOS and potentially gain System Management Mode execution. The report said no new Intel vulnerability was disclosed but warned that many organizations remain exposed to known ME and AMT flaws.
Trellix said it detected a public sample of Conti's Linux variant targeting VMware ESXi on April 4, 2022, after it triggered threat-hunting rules. The authors described it as the first public sample of the ESXi-targeting variant they had seen in the wild.
KrebsOnSecurity analyzed leaked internal chat logs and described Conti as a structured cybercriminal enterprise with HR, coding, testing, administration, reverse engineering, and intrusion teams. The report also highlighted staffing, salaries, and reliance on Trickbot and Emotet infrastructure.
An unknown individual began leaking internal information and communications from the Conti ransomware organization in late February 2022. The leaks later exposed Conti's internal structure, tooling, and research interests.
Leaked chats indicate fixes and adjustments to the Linux ESXi-targeting variant continued into February 2022, including support for ESXi 7.0 and higher. The malware and decryptor had experienced bugs through late 2021.
On November 22, 2021, Cybergangster asked Bio to help translate instructions for the Conti Linux decryptor. The request reflected ongoing work to support victims paying for decryption on Linux/ESXi cases.
Ireland’s Health Service Executive did not fully restore all systems until September 21, 2021, following the May ransomware attack. Recovery costs were estimated at more than $600 million.
Cisco Talos published its translated analysis of the leaked Conti playbook and associated Cobalt Strike manual. The report said the documents lowered the barrier to entry for less-skilled affiliates and revealed detailed enterprise intrusion procedures.
A leaked Conti ransomware playbook and related Cobalt Strike manual were allegedly released by an affiliate known as m1Geelka after a payment dispute. Cisco Talos later analyzed and translated the materials, which exposed Conti's operational guidance and tooling.
An August 2021 leaked Conti playbook warned that the Linux ransomware variant might not launch on certain operating system versions. This documented operational limitations in the group's ESXi-focused tooling.
On July 30, 2021, Mango said Conti’s payroll had increased to 87 salaried employees. The leaked chats show rapid staffing growth within weeks.
Mango stated that as of July 18, 2021, Conti employed 62 people, mostly low-level malware coders and software testers. The figure illustrates the group's corporate-style staffing model.
In July 2021, manager Mango said Conti was placing recruitment advertisements on several Russian-language cybercrime forums. The postings advertised salaries around $2,000, with some coders earning substantially more.
Conti attacked Ireland’s Health Service Executive, disrupting several hospitals and causing a near-complete shutdown of national and local networks. The incident became one of the major attacks tied to the group in 2021.
In May 2021, senior figure Stern said he wanted 100 more encoders hired before summer vacations, with many planned for intrusion teams led by Hof and Reverse. The chats show Conti scaling its workforce to support operations.
Leaked Conti communications show the first mention of a Linux ransomware locker targeting VMware ESXi in early May 2021. Testing and refinement of the locker and decryptor then continued over the following months.
An October 2020 Conti chat showed a senior figure known as Professor recognizing his own batch file in analysis of Ryuk activity. The exchange supported claims of overlap between the Ryuk and Conti operations.
Leaked chats suggest the same managers may have run both Ryuk and Conti and that a gradual migration to Conti occurred in June 2020. An October 2020 chat later reinforced the operational overlap between the two ransomware brands.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
microsoft.com
Open sourcetrellix.com
Open sourceeclypsium.com
Open sourcekrebsonsecurity.com
Open sourceblog.talosintelligence.com
Open sourcethreatpost.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A disgruntled Conti affiliate leaked the gang’s internal training manuals on the XSS cybercrime forum, exposing how affiliates were taught to breach corporate networks, move laterally, escalate privileges, exfiltrate data, and deploy ransomware. The archive reportedly contained 37 text files covering common intrusion tooling such as **Cobalt Strike**, **Rclone**, **AnyDesk**, **Metasploit**, **Ngrok**, and **NetScan**, along with guidance for **NTDS** dumping, **Kerberoasting**, **SMB** brute forcing, and exploitation of **Zerologon** (`CVE-2020-1472`) to obtain domain-level access. The leaks later expanded beyond operational manuals to include source code for two **TrickBot** components—the **Command Dispatcher** and **Data Collector**—as well as the reported doxxing of a Conti developer. Although much of the exposed material reflected known ransomware tradecraft rather than novel techniques, the disclosures provided defenders with rare visibility into Conti’s affiliate operations, tooling, and procedures, helping organizations refine detections and response playbooks against Conti- and TrickBot-linked intrusions.
Aug 15, 2026
Leaked internal communications from the Conti ransomware operation exposed one of the clearest views yet into a major cybercrime enterprise run like a legitimate technology company. Material published beginning on 27 February 2022 after Conti publicly backed Russia included tens of thousands of Jabber messages, source code, infrastructure details, operational guidance, and translated archives shared through public repositories. The leaks showed Conti had structured management, HR, developers, testers, recruiters, support staff, payroll, and defined working practices, with some reporting describing roughly 150 members and others documenting more than 160,000 messages among nearly 500 actors tied to Conti and related operations. Researchers said the disclosures revealed a mature ransomware-as-a-service and double-extortion business that had already become one of the most damaging strains globally, with the FBI previously linking Conti to more than 1,000 victims and over $150 million in victim payments by early 2022. The leaked chats also mapped Conti’s wider ecosystem, showing overlap with TrickBot, BazarLoader, Ryuk, LockBit, Maze, Ragnar Locker, Emotet, IcedID, Buer, Amadey, and other malware operations, while indicating the group often avoided Russian and Chinese targets and may have had links to Russian state interests. Analysts said the disclosures uncovered victim-selection methods, attack infrastructure, salaries, and collaboration patterns, while also creating a proliferation risk by giving other criminals access to Conti tradecraft and code. Despite the exposure, reporting indicated the group continued operations, adapted its tooling and intrusion methods, and may have influenced or re-emerged through later activity such as Monti, underscoring that the leak disrupted secrecy more than it ended the threat.
Aug 15, 2026
A pro-Ukraine actor leaked **Conti Ransomware V3.0** source code, a compiled locker, and a decryptor, exposing the inner workings of one of the most active Russian-speaking ransomware operations. Researchers reviewing the leak said the code was functional and tied it to a broader stream of disclosures that also revealed Conti’s internal chats, tools, training materials, and administrative panels. Technical analysis of the leaked `conti_v3.sln` project showed API hashing and anti-hooking for evasion, multithreaded encryption, use of `CryptGenRandom`, RSA, and the **ChaCha** stream cipher, plus logic for full or partial encryption based on file type and size, including special handling for databases and virtual machine files. The leak gave defenders unusually detailed visibility into a group that had already evolved from **Ryuk**-linked operations and adopted double extortion through its **Conti.News** leak site, where stolen data was published to pressure victims. Separate reporting also documented active Conti affiliates using tools such as **Cobalt Strike** and **PsExec** against U.S. organizations, while independent researchers published unpacking work for Conti samples using FireEye’s **Speakeasy** emulation framework to dump unpacked payloads from memory and repair imports. Together, the disclosures increased defensive insight into Conti’s malware and operations, while also raising the risk that other threat actors could reuse the leaked code and techniques.
Aug 15, 2026