Loading story…
A pro-Ukraine actor leaked Conti Ransomware V3.0 source code, a compiled locker, and a decryptor, exposing the inner workings of one of the most active Russian-speaking ransomware operations. Researchers reviewing the leak said the code was functional and tied it to a broader stream of disclosures that also revealed Conti’s internal chats, tools, training materials, and administrative panels. Technical analysis of the leaked conti_v3.sln project showed API hashing and anti-hooking for evasion, multithreaded encryption, use of CryptGenRandom, RSA, and the ChaCha stream cipher, plus logic for full or partial encryption based on file type and size, including special handling for databases and virtual machine files.
The leak gave defenders unusually detailed visibility into a group that had already evolved from Ryuk-linked operations and adopted double extortion through its Conti.News leak site, where stolen data was published to pressure victims. Separate reporting also documented active Conti affiliates using tools such as Cobalt Strike and PsExec against U.S. organizations, while independent researchers published unpacking work for Conti samples using FireEye’s Speakeasy emulation framework to dump unpacked payloads from memory and repair imports. Together, the disclosures increased defensive insight into Conti’s malware and operations, while also raising the risk that other threat actors could reuse the leaked code and techniques.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
On March 20, 2022, the pro-Ukraine researcher ContiLeaks uploaded the source code for Conti Ransomware V3.0 to VirusTotal along with a compiled locker and decryptor. The leak continued a broader campaign exposing Conti's internal tools, chats, and infrastructure after the group's public support for Russia.
Technical analysis published in March 2022 examined the leaked Conti codebase, including the conti_v3.sln project, API hashing, anti-hooking, multithreaded encryption, and use of ChaCha and RSA. The analysis framed the leak as a significant exposure of Conti's locker and decryptor internals.
A previously leaked older Conti ransomware source code version was described as having source files last modified on January 25, 2021. Later reporting used this date to distinguish the older codebase from the newer V3 leak.
By August 2020 reporting, researchers said TrickBot-linked operators had stopped broadly deploying Ryuk since July 2020 and were deploying Conti instead. Conti also launched its Conti.News data leak site, listing 26 victims and formalizing its double-extortion model.
Threatpost reported that eSentire had published a report on a newly identified Conti affiliate that used Cobalt Strike and PsExec in attacks against seven U.S. companies across multiple sectors between 2021 and 2022. The report included accounts, IP addresses, domains, and ProtonMail addresses tied to the affiliate.
A GitHub repository published an automatic unpacker for a specific Conti sample using FireEye's Speakeasy framework. The author documented halting execution at the first VirtualProtect call, dumping the unpacked PE from memory, and attempting to repair its import table, while noting the method was not fully reliable.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
fireeye.com
Open sourcecocomelonc.github.io
Open sourcethreatpost.com
Open sourcegithub.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Leaked internal communications from the Conti ransomware operation exposed one of the clearest views yet into a major cybercrime enterprise run like a legitimate technology company. Material published beginning on 27 February 2022 after Conti publicly backed Russia included tens of thousands of Jabber messages, source code, infrastructure details, operational guidance, and translated archives shared through public repositories. The leaks showed Conti had structured management, HR, developers, testers, recruiters, support staff, payroll, and defined working practices, with some reporting describing roughly 150 members and others documenting more than 160,000 messages among nearly 500 actors tied to Conti and related operations. Researchers said the disclosures revealed a mature ransomware-as-a-service and double-extortion business that had already become one of the most damaging strains globally, with the FBI previously linking Conti to more than 1,000 victims and over $150 million in victim payments by early 2022. The leaked chats also mapped Conti’s wider ecosystem, showing overlap with TrickBot, BazarLoader, Ryuk, LockBit, Maze, Ragnar Locker, Emotet, IcedID, Buer, Amadey, and other malware operations, while indicating the group often avoided Russian and Chinese targets and may have had links to Russian state interests. Analysts said the disclosures uncovered victim-selection methods, attack infrastructure, salaries, and collaboration patterns, while also creating a proliferation risk by giving other criminals access to Conti tradecraft and code. Despite the exposure, reporting indicated the group continued operations, adapted its tooling and intrusion methods, and may have influenced or re-emerged through later activity such as Monti, underscoring that the leak disrupted secrecy more than it ended the threat.
Aug 15, 2026
A disgruntled Conti affiliate leaked the gang’s internal training manuals on the XSS cybercrime forum, exposing how affiliates were taught to breach corporate networks, move laterally, escalate privileges, exfiltrate data, and deploy ransomware. The archive reportedly contained 37 text files covering common intrusion tooling such as **Cobalt Strike**, **Rclone**, **AnyDesk**, **Metasploit**, **Ngrok**, and **NetScan**, along with guidance for **NTDS** dumping, **Kerberoasting**, **SMB** brute forcing, and exploitation of **Zerologon** (`CVE-2020-1472`) to obtain domain-level access. The leaks later expanded beyond operational manuals to include source code for two **TrickBot** components—the **Command Dispatcher** and **Data Collector**—as well as the reported doxxing of a Conti developer. Although much of the exposed material reflected known ransomware tradecraft rather than novel techniques, the disclosures provided defenders with rare visibility into Conti’s affiliate operations, tooling, and procedures, helping organizations refine detections and response playbooks against Conti- and TrickBot-linked intrusions.
Aug 15, 2026
The **Conti** ransomware operation faced a major internal data leak after publicly backing Russia during the invasion of Ukraine and warning it would use its “full capacity” to retaliate against Western cyberattacks on Russian critical infrastructure. Researchers and media reports said activists released roughly **60,000 internal messages**, reportedly from the gang’s Jabber server, exposing more than a year of conversations and offering an unusually detailed view into one of the most prolific ransomware groups tied to Russia. The leaked chats were described as shedding light on Conti’s internal structure, tactics, and past operations, including activity linked to high-profile incidents such as the attack on Ireland’s public health service. Reporting also highlighted Conti’s use of the **ProxyShell** exploit in attacks against healthcare targets and the deployment of scripts to disable **Windows Defender** before encryption. The fallout appeared to ripple across the cybercrime ecosystem, with rival ransomware group **LockBit** publicly distancing itself from geopolitics and emphasizing that it was motivated by profit rather than allegiance to any state.
Jun 29, 2026