Loading story…
Leaked Conti communications and ransomware source code exposed the Russian-speaking group’s internal operations after it declared support for Russia’s invasion of Ukraine in 2022. A Ukrainian cybersecurity researcher released 60,694 messages across 393 JSON files, which other researchers subsequently validated. ReliaQuest found a structured organization with persistent leadership, defined employment practices, and communications concentrated among a small number of users. Messaging dropped substantially on weekends and correlated with newly reported victims, but those patterns do not establish when attacks occurred; explanations for individual activity spikes remain speculative.
Tenable identified more than 30 vulnerabilities associated with Conti and its affiliates, with privilege-escalation flaws accounting for nearly three quarters of those disclosed in the communications. The group combined multiple initial-access methods with post-compromise techniques aimed at obtaining domain administrator privileges and encrypting systems across victim networks. Most listed vulnerabilities already had patches available, underscoring the need to address both internet-facing exposure and internal escalation paths. MITRE’s separate reporting identifies AdFind as an Active Directory reconnaissance utility used by numerous intrusion sets, including Wizard Spider, reinforcing the importance of monitoring directory enumeration alongside privilege escalation rather than relying on perimeter defenses alone.
See which actors are running it and whether you're in range.
15 events from the most recent confirmed update back to the earliest known activity.
BreachQuest published an analysis of the leaked communications identifying vulnerabilities that Conti appeared to use against organizations.
Later in March, the same researcher uploaded the source code for version three of Conti ransomware to VirusTotal.
At the start of March, the researcher released a password-protected archive containing an older version of Conti's ransomware source code.
A Ukrainian cybersecurity researcher, described by another source as an alleged Conti member, publicly leaked internal Conti conversations. The dataset contained 60,694 messages in 393 JSON files and allegedly originated from the backend of Conti's Jabber server.
Conti advertised for networkers, access providers, penetration testers, and individuals with access to corporate botnets.
Conti acknowledged an infrastructure attack. A representative claimed that no information about its systems or personnel was exposed and that all systems had been restored following a security audit.
An affiliate leaked Conti training materials and operational details, including alleged server IP addresses, an administrator's username and Jabber ID, and a Tor chat link. The leaker alleged that recruits received an insufficient share of ransom payments.
A cybercriminal forum user shared approximately 27 GB of Conti material, including red-teaming videos, tools, and malicious PowerShell scripts.
Conti attacked Ireland's Health Service Executive and demanded a $20 million ransom. The organization refused to pay.
Conti and its affiliates reportedly began exploiting CVE-2021-44228, known as Log4Shell, in attacks in late 2021.
Carbon Black researchers first discovered the Conti ransomware in 2020.
The password-protected archive was subsequently cracked, and its source-code contents were published online.
Other cybersecurity researchers subsequently confirmed the validity of the leaked internal communications.
Conti revised its statement supporting Russia to soften its rhetoric about retaliatory attacks.
Conti declared support for Russia's invasion of Ukraine and threatened retaliatory attacks against critical infrastructure belonging to organizations or nations conducting cyberattacks or war activities against Russia.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
reliaquest.com
Open sourcetenable.com
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Leaked internal communications from the Conti ransomware operation exposed one of the clearest views yet into a major cybercrime enterprise run like a legitimate technology company. Material published beginning on 27 February 2022 after Conti publicly backed Russia included tens of thousands of Jabber messages, source code, infrastructure details, operational guidance, and translated archives shared through public repositories. The leaks showed Conti had structured management, HR, developers, testers, recruiters, support staff, payroll, and defined working practices, with some reporting describing roughly 150 members and others documenting more than 160,000 messages among nearly 500 actors tied to Conti and related operations. Researchers said the disclosures revealed a mature ransomware-as-a-service and double-extortion business that had already become one of the most damaging strains globally, with the FBI previously linking Conti to more than 1,000 victims and over $150 million in victim payments by early 2022. The leaked chats also mapped Conti’s wider ecosystem, showing overlap with TrickBot, BazarLoader, Ryuk, LockBit, Maze, Ragnar Locker, Emotet, IcedID, Buer, Amadey, and other malware operations, while indicating the group often avoided Russian and Chinese targets and may have had links to Russian state interests. Analysts said the disclosures uncovered victim-selection methods, attack infrastructure, salaries, and collaboration patterns, while also creating a proliferation risk by giving other criminals access to Conti tradecraft and code. Despite the exposure, reporting indicated the group continued operations, adapted its tooling and intrusion methods, and may have influenced or re-emerged through later activity such as Monti, underscoring that the leak disrupted secrecy more than it ended the threat.
Aug 15, 2026
A pro-Ukraine actor leaked **Conti Ransomware V3.0** source code, a compiled locker, and a decryptor, exposing the inner workings of one of the most active Russian-speaking ransomware operations. Researchers reviewing the leak said the code was functional and tied it to a broader stream of disclosures that also revealed Conti’s internal chats, tools, training materials, and administrative panels. Technical analysis of the leaked `conti_v3.sln` project showed API hashing and anti-hooking for evasion, multithreaded encryption, use of `CryptGenRandom`, RSA, and the **ChaCha** stream cipher, plus logic for full or partial encryption based on file type and size, including special handling for databases and virtual machine files. The leak gave defenders unusually detailed visibility into a group that had already evolved from **Ryuk**-linked operations and adopted double extortion through its **Conti.News** leak site, where stolen data was published to pressure victims. Separate reporting also documented active Conti affiliates using tools such as **Cobalt Strike** and **PsExec** against U.S. organizations, while independent researchers published unpacking work for Conti samples using FireEye’s **Speakeasy** emulation framework to dump unpacked payloads from memory and repair imports. Together, the disclosures increased defensive insight into Conti’s malware and operations, while also raising the risk that other threat actors could reuse the leaked code and techniques.
Aug 15, 2026
Leaked internal chats, playbooks, and malware samples exposed **Conti** as a highly structured ransomware enterprise that combined mature intrusion operations with ongoing development of new attack paths. Reporting on the leaks showed the group maintained specialized teams for coding, testing, administration, reverse engineering, and intrusions, relied on **Trickbot** and **Emotet** infrastructure, and provided affiliates with detailed guidance for enterprise compromise. The leaked playbook documented heavy use of **Cobalt Strike**, **AdFind**, **SharpView**, **SharpChrome**, **SeatBelt**, and **GMER**, along with credential theft, Active Directory reconnaissance, administrator targeting, and exploitation of **`CVE-2020-1472`** to accelerate domain-wide access.
Aug 15, 2026